Listen to this Post
How the mentioned CVE works
The vulnerability exists in OpenClaw’s media fetching logic when handling HTTP error responses.
Before the fix, the function responsible for reading non‑2xx responses did not impose a size limit on the error body.
When a remote server returned an error (e.g., 4xx/5xx) with a large or streaming payload, the client would attempt to buffer the entire body into memory.
Because there was no cap, an attacker could trigger a malicious endpoint that sends a huge error response (e.g., gigabytes of data).
This caused the Node.js process to allocate unbounded memory, leading to out‑of‑memory conditions and denial of service.
The issue affected all versions of `openclaw` prior to 2026.3.22.
The fix was introduced in commit `81445a901091a5d27ef0b56fceedbe4724566438`.
Two key files were modified:
– `src/media/fetch.ts` now routes non‑2xx failures through a bounded read mechanism.
– `src/media/read-response-with-limit.ts` enforces a hard limit (default 1 MiB) on error bodies, truncating oversized snippets.
This ensures that even if an error response is arbitrarily large, only a controlled prefix is read before failure handling.
The change also prevents memory exhaustion attacks from remote media servers or any source that can influence HTTP error responses.
The fix shipped in `v2026.3.22` and remains present in later versions (v2026.3.23, v2026.3.23-2).
No CVE identifier was assigned for this vulnerability.
dailycve form
Platform: openclaw npm
Version: < 2026.3.22
Vulnerability: Unbounded memory allocation
Severity: Medium
date: 2026-03-26
Prediction: 2026-03-22
What Undercode Say:
Check installed openclaw version npm list openclaw Test for vulnerable behaviour (requires malicious server) curl -H "Accept: application/json" http://attacker.com/large-error Verify fix applied in src/media/read-response-with-limit.ts grep -n "MAX_ERROR_BODY_SIZE" node_modules/openclaw/dist/media/read-response-with-limit.js
// Pre-fix pseudo-code (vulnerable) const errorBody = await response.text(); // no limit // Post-fix (safe) const errorBody = await readResponseWithLimit(response, MAX_LIMIT);
how Exploit:
- Attacker controls a media URL that returns an HTTP error (e.g., 500) with a huge body (e.g., 10 GB).
- Victim’s OpenClaw instance fetches that URL via its media handler.
- The client attempts to read the full error body into memory, exhausting available RAM.
- Process crashes or becomes unresponsive, causing denial of service.
Protection from this CVE
- Upgrade to `openclaw >= 2026.3.22` immediately.
- If upgrading is not possible, apply the fix manually by backporting the bounded read logic from commit
81445a901091a5d27ef0b56fceedbe4724566438. - Consider network-level filtering to block responses from untrusted media sources that may send oversized error bodies.
Impact
- Remote denial of service via memory exhaustion.
- Affects all prior versions of the OpenClaw npm package.
- No data leak or privilege escalation – purely a crash / availability issue.
- Medium severity due to local impact (single process) and requirement of a malicious or compromised media endpoint.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
