Skip to content
Heist/ feed
Back to feed
Medium

OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook

Type: advisorySources: OSV

OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-35626
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 02:01 UTC · Revision 1

Source evidence

OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook

core-osv · Original source

Published 9 Apr 2026, 21:26 UTC

OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation.

osv:CVE-2026-35626
Complete source record
{
  "id": "a5bda5282f740b9e535a9b533937fe58b147a9395022ecea99a949c425422a54",
  "url": "https://osv.dev/vulnerability/CVE-2026-35626",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook",
    "summary": "OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation.",
    "evidence": "osv:CVE-2026-35626",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-35626",
      "aliases": [
        "CVE-2026-35626",
        "GHSA-rm59-992w-x2mv"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/openclaw/openclaw",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "e7d11f6c33e223a0dd8a21cfe01076bd76cef87a"
                },
                {
                  "fixed": "630f1479c44f78484dfa21bb407cbe6f171dac87"
                },
                {
                  "fixed": "651dc7450b68a5396a009db78ef9382633707ead"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2026.3.22"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "630f1479c44f78484dfa21bb407cbe6f171dac87"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "651dc7450b68a5396a009db78ef9382633707ead"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2026.3.13-1",
            "v2026.3.13",
            "v2026.3.12",
            "v2026.3.11",
            "v2026.3.11-beta.1",
            "v2026.3.8",
            "v2026.3.8-beta.1",
            "v2026.3.7",
            "v2026.3.7-beta.1",
            "v2026.3.2-beta.1",
            "v2026.3.2",
            "v2026.3.1",
            "v2026.2.26",
            "v2026.2.26-beta.1",
            "v2026.2.25",
            "v2026.2.25-beta.1",
            "v2026.2.24",
            "v2026.2.24-beta.1",
            "v2026.2.23",
            "v2026.2.23-beta.1",
            "v2026.2.22",
            "v2026.2.22-beta.1",
            "v2026.2.21",
            "v2026.2.21-beta.1",
            "v2026.2.19-beta.1",
            "v2026.2.19",
            "v2026.2.17",
            "v2026.2.15-beta.1",
            "v2026.2.14",
            "v2026.2.13",
            "v2026.2.12",
            "v2026.2.9",
            "v2026.2.6-3",
            "v2026.2.6-2",
            "v2026.2.6-1",
            "v2026.2.6",
            "v2026.2.3",
            "v2026.2.2",
            "v2026.2.1",
            "v2026.1.30",
            "v2026.1.29",
            "v2026.1.24-1",
            "v2026.1.24",
            "v2026.1.23",
            "v2026.1.22",
            "v2026.1.21",
            "v2026.1.20",
            "v2026.1.16-2",
            "v2026.1.15",
            "v2026.1.14-1",
            "v2026.1.13",
            "v2026.1.12-2",
            "v2026.1.12",
            "v2026.1.11-3",
            "v2026.1.11-2",
            "v2026.1.11-1",
            "v2026.1.11",
            "v2026.1.10",
            "v2026.1.9",
            "v2026.1.8",
            "v2026.1.5-3",
            "v2026.1.5-2",
            "v2026.1.5-1",
            "v2026.1.5",
            "v2.0.0-beta5",
            "v2.0.0-beta4",
            "v2.0.0-beta3",
            "v2.0.0-beta2",
            "v2.0.0-beta1",
            "v1.3.0",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.0",
            "v1.0.4",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35626.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.136978752Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35626.json",
        "https://github.com/openclaw/openclaw/security/advisories/GHSA-rm59-992w-x2mv",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-35626",
        "https://www.vulncheck.com/advisories/openclaw-unauthenticated-resource-exhaustion-via-voice-call-webhook",
        "https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87",
        "https://github.com/openclaw/openclaw/commit/651dc7450b68a5396a009db78ef9382633707ead"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-405"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35626.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-35626",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 521585,
  "published_at": "2026-04-09T21:26:58.441+00:00"
}