OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice‑call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the voice‑call realtime WebSocket path. The flaw is characterized by CWE‑770 and allows attackers to exhaust resources.

OpenClaw 2026.4.9 and earlier releases before 2026.4.10 are affected. The products are listed under the OpenClaw vendor and the impacted version range is any release older than 2026.4.10. Future versions such as 2026.4.10 contain the public fix.

The CVSS score of 8.2 ranks the flaw as High, and the EPSS score of < 1% indicates a very low probability of exploitation. The flaw is not noted in the CISA KEV catalog. The likely attack vector is remote, with an adversary able to send malicious WebSocket frames over the network to a publicly exposed endpoint. Successful exploitation would cause denial of service for all users of the vulnerable deployment.