Every CVE Search/ Get API key

CVE-2026-28478

OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering

8.7 HighFix available

OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits. Remote unauthenticated attackers can send oversized JSON payloads or slow uploads to webhook endpoints causing memory pressure and availability degradation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.51%Up 0.4 points since Mar 6, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering

OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits. Remote unauthenticated attackers can send oversized JSON payloads or slow uploads to webhook endpoints causing memory pressure and availability degradation.

Record
CVE-2026-28478
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-9924 8.7

OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits. Remote unauthenticated attackers can send oversized JSON payloads or slow uploads to webhook endpoints causing memory pressure and availability degradation.

Record
EUVD-2026-9924
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-q447-rj3r-2cgh 7.5

OpenClaw affected by denial of service via unbounded webhook request body buffering

Summary

Multiple webhook handlers accepted and buffered request bodies without a strict unified byte/time limit. A remote unauthenticated attacker could send oversized payloads and cause memory pressure, degrading availability.

Details

Affected packages:

  • openclaw (npm): <2026.2.12
  • clawdbot (npm): <=2026.1.24-3

Root cause:

  • Webhook code paths buffered request payloads without consistent maxBytes + timeoutMs enforcement.
  • Some SDK-backed handlers parse request bodies internally and needed stream-level guards.

Attack shape:

  • Send very large JSON payloads or slow/incomplete uploads to webhook endpoints.
  • Observe elevated memory usage and request handler pressure.

Impact

Remote unauthenticated availability impact (DoS) via request body amplification/memory pressure.

Patch details (implemented)

  • Added shared bounded request-body helper in src/infra/http-body.ts.
  • Exported helper in src/plugin-sdk/index.ts for extension reuse.
  • Migrated webhook body readers to shared helper for:
    • LINE
    • Nextcloud Talk
    • Google Chat
    • Zalo
    • BlueBubbles
    • Nostr profile HTTP
    • Voice-call
    • Gateway hooks
  • Added stream guards for SDK handlers that parse request bodies internally:
    • Slack
    • Telegram
    • Feishu
  • Added explicit Express JSON body limit handling for MS Teams webhook path.
  • Standardized failure responses:
    • 413 Payload Too Large
    • 408 Request Timeout

Tests

  • Added regression tests:
    • src/infra/http-body.test.ts
    • src/line/monitor.read-body.test.ts
    • extensions/nextcloud-talk/src/monitor.read-body.test.ts
  • Focused webhook/security test suite passes for patched paths.

Remediation

Upgrade to the first release containing this patch.

Credits

Thanks @vincentkoc for reporting.

Record
GHSA-q447-rj3r-2cgh
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 8.7

OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits. Remote unauthenticated attackers can send oversized JSON payloads or slow uploads to webhook endpoints causing memory pressure and availability degradation.

Record
CVE-2026-28478
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSV 8.7

OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering

OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits. Remote unauthenticated attackers can send oversized JSON payloads or slow uploads to webhook endpoints causing memory pressure and availability degradation.

Record
CVE-2026-28478
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
OSVGHSA-q447-rj3r-2cgh 7.5

OpenClaw affected by denial of service via unbounded webhook request body buffering

Summary

Multiple webhook handlers accepted and buffered request bodies without a strict unified byte/time limit. A remote unauthenticated attacker could send oversized payloads and cause memory pressure, degrading availability.

Details

Affected packages:

  • openclaw (npm): <2026.2.12
  • clawdbot (npm): <=2026.1.24-3

Root cause:

  • Webhook code paths buffered request payloads without consistent maxBytes + timeoutMs enforcement.
  • Some SDK-backed handlers parse request bodies internally and needed stream-level guards.

Attack shape:

  • Send very large JSON payloads or slow/incomplete uploads to webhook endpoints.
  • Observe elevated memory usage and request handler pressure.

Impact

Remote unauthenticated availability impact (DoS) via request body amplification/memory pressure.

Patch details (implemented)

  • Added shared bounded request-body helper in src/infra/http-body.ts.
  • Exported helper in src/plugin-sdk/index.ts for extension reuse.
  • Migrated webhook body readers to shared helper for:
    • LINE
    • Nextcloud Talk
    • Google Chat
    • Zalo
    • BlueBubbles
    • Nostr profile HTTP
    • Voice-call
    • Gateway hooks
  • Added stream guards for SDK handlers that parse request bodies internally:
    • Slack
    • Telegram
    • Feishu
  • Added explicit Express JSON body limit handling for MS Teams webhook path.
  • Standardized failure responses:
    • 413 Payload Too Large
    • 408 Request Timeout

Tests

  • Added regression tests:
    • src/infra/http-body.test.ts
    • src/line/monitor.read-body.test.ts
    • extensions/nextcloud-talk/src/monitor.read-body.test.ts
  • Focused webhook/security test suite passes for patched paths.

Remediation

Upgrade to the first release containing this patch.

Credits

Thanks @vincentkoc for reporting.

Record
GHSA-q447-rj3r-2cgh
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 before 2026.2.13
2026.2.13
clawdbot
npm
 through 2026.1.24-3 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-28478 is a high vulnerability (CVSS 8.7) in Openclaw, published February 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in openclaw 2026.2.13.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open