The vulnerability lies in the voice‑call component of OpenClaw, which parses large WebSocket frames before performing any pre‑start validation. An attacker can send an oversized frame, causing the system to allocate excessive resources and ultimately deny service. This flaw directly enables a remote denial of service.

OpenClaw products built with any version prior to 2026.3.31 are affected. The issue is specific to the OpenClaw voice‑call module.

The CVSS score of 6.9 indicates moderate severity. No EPSS data is available, and the entry is not listed in the CISA KEV catalog, suggesting the flaw is not known to be widely exploited yet. The likely attack vector is a remote attacker sending a large WebSocket frame, probably unauthenticated, to trigger the resource exhaustion. Manual exploitation would require the ability to open a WebSocket connection to the affected voice‑call endpoint.