The vulnerability lies in the WebSocket handling of the Voice‑call realtime route, where incoming frames are accepted without length checks. An attacker could send a frame that exceeds the expected size, causing resource exhaustion and rendering the service unresponsive. The primary impact is that users of deployments exposing this webhook path cannot place or receive voice calls while the service is compromised. The weakness is captured by CWE‑770, indicating an excessive resource consumption flaw.

OpenClaw 2026.4.9 and earlier releases before 2026.4.10 are affected. The products are listed under the OpenClaw vendor and the impacted version range is any release older than 2026.4.10. Future versions such as 2026.4.10 contain the public fix.

The CVSS score of 8.2 ranks the flaw as High and the lack of a publicly available EPSS score leaves the exact exploit probability unknown. The flaw is not noted in the CISA KEV catalog. The likely attack vector is remote, with an adversary able to send malicious WebSocket frames over the network to a publicly exposed endpoint. Successful exploitation would cause denial of service for all users of the vulnerable deployment.