CVE-2026-32066
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
CVE-2026-32066 has been rejected by its source and should not be treated as a live vulnerability, published March 2, 2026. Fixed in openclaw 2026.3.1.
- Severity
- 6.9 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2026.3.1openclaw +1 more
Description
This CVE ID has been rejected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
What each source reports
GitHub Advisories Score usedGHSA-wr6m-jg37-68xh
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
Summary
Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route.
Impact
An attacker could cause memory pressure and potential process instability or OOM, degrading availability.
Fix
Webhook security tracking now normalizes keys to matched webhook path semantics (query excluded) and bounds/prunes tracking state to prevent unbounded growth.
Affected and Patched Versions
- Affected:
<= 2026.2.26 - Patched:
2026.3.1
- Record
GHSA-wr6m-jg37-68xh- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE ListNo score
This CVE ID has been rejected.
- Record
CVE-2026-32066- Updated
- 2026-11-02
EUVDEUVD-2026-14565
This CVE ID has been rejected.
- Record
EUVD-2026-14565- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVDNo score
Rejected reason: This CVE ID has been rejected.
- Record
CVE-2026-32066- Updated
- 2026-11-02
OSVCVE-2026-28461
OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn
OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different query parameters to cause memory pressure, process instability, or out-of-memory conditions that degrade service availability.
- Record
CVE-2026-28461- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-wr6m-jg37-68xh
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
Summary
Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route.
Impact
An attacker could cause memory pressure and potential process instability or OOM, degrading availability.
Fix
Webhook security tracking now normalizes keys to matched webhook path semantics (query excluded) and bounds/prunes tracking state to prevent unbounded growth.
Affected and Patched Versions
- Affected:
<= 2026.2.26 - Patched:
2026.3.1
- Record
GHSA-wr6m-jg37-68xh- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh
nvd.nist.gov/vuln/detail/CVE-2026-28461
vulncheck.com/advisories/openclaw-unbounded-memory-growth-in-zalo-webhook-via-query-string-key-churn