EUVD-2026-90254
GHSA-xxhw-cvh5-24pv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish gateway WebSocket connection to node
-
DeliveryStream continuation frames without EndOfMessage
-
ExploitUnbounded StringBuilder accumulation
-
ExecutionNode memory exhausted
-
ImpactProcess crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an already-connected gateway peer on the node's gateway WebSocket transport (PR:L - the attacker must be able to open/maintain a gateway WebSocket session). The concrete trigger is sending a multi-frame WebSocket text message as an unbounded sequence of continuation frames that never set the EndOfMessage flag, causing the pre-patch ListenForMessagesAsync receive loop to append frames into a StringBuilder with no total-size limit. Limiting factors: only OpenClaw Windows Node versions before 2026.7.1 are affected; the attacker must reach and connect to the gateway transport as a gateway (not a fully unauthenticated internet scan against defaults); impact is capped at a process crash (no code execution, no data exposure); patched builds enforce a 32M UTF-16-char cap and close the socket with MessageTooBig. |
| Impact | This is a genuine but bounded-impact issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) plus a 7.1 score reflects a network-reachable, low-complexity flaw requiring some privilege (PR:L), and the impact metrics confirm it is purely availability (VC:N/VI:N/VA:H) - a memory-exhaustion crash, not code execution or data disclosure. No EPSS score was supplied, there is no CISA KEV listing, and no public exploit code was identified, so all signals point to a real-but-non-urgent defect rather than a mass-exploited threat. The SSVC-relevant technical impact is partial (availability only) and, while the crash is trivially automatable once a gateway connection exists, exploitation is gated on being a connected/authenticated gateway peer (PR:L). Net: a legitimate priority for OpenClaw Windows Node operators to patch, but not a high-real-risk RCE despite the 7.1 headline; the DoS ceiling and the authenticated/connected-peer prerequisite substantially limit blast radius. |
| Exploit ScenarioDerived | A malicious or compromised gateway that has established a WebSocket connection to an OpenClaw Windows Node sends an unending stream of continuation frames that never set the EndOfMessage flag. The node's receive loop keeps appending each decoded frame to an in-memory StringBuilder with no total cap, growing memory until the node process is killed by the OS. No public exploit code was identified, but the technique is trivial to script and the fix commit and regression test publicly describe the exact mechanism. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Memory exhaustion in OpenClaw Windows Node versions before 2026.7.1 lets a connected gateway peer crash the node process by streaming an unbounded sequence of WebSocket continuation frames that never set the EndOfMessage flag, driving limitless growth of the inbound message accumulation buffer until the process dies. The vulnerability is authenticated (CVSS PR:L) because the attacker must already hold a gateway session on the node's gateway WebSocket transport rather than merely reach an exposed port, and the impact is confined to availability - a process crash with no code execution, privilege escalation, or data exposure. No public exploit code has been identified at time of analysis, and the vendor has shipped 2026.7.1, which caps accumulated inbound messages at 32M UTF-16 characters and closes offending sockets with a MessageTooBig status.
RemediationAI
Upgrade OpenClaw Windows Node to 2026.7.1 or later - the vendor-released patch (available per vendor advisory and the GHSA-xxr2-xm56-9cw5 notice) enforces a 32M UTF-16-character ceiling on accumulated inbound messages and terminates the WebSocket with MessageTooBig when a peer exceeds it; the corresponding source fix is commit 1810e357aa0d0639099b347f31c746ba7d31512a, and the release is at https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1. If immediate upgrade is not possible, compensating controls focus on reducing the attack surface rather than eliminating the bug: restrict which gateway peers may establish sessions on the node's gateway WebSocket transport (for example, bind the listener to loopback or a management VLAN and require gateway authentication), which preserves functionality for trusted gateways but does nothing against a compromised or malicious gateway that already passes that filter; run the node process under an OS-enforced memory cap (Job Object / container memory limit) so exhaustion kills and restarts a bounded sandbox rather than destabilizing the host, accepting that the node will still be repeatedly terminated; and add monitoring on node RSS growth plus WebSocket close-code telemetry to detect sustained continuation-frame floods early, though this detects rather than prevents the crash. Vendor advisory reference: https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-denial-of-service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue lives in the .NET client-side WebSocket receive loop implemented in src/OpenClaw.Shared/WebSocketClientBase.cs (the pre-patch region around lines 217-263). Per RFC 6455, a WebSocket text message may be fragmented across any number of frames; the receiver must accumulate fragments until a frame arrives with the FIN/EndOfMessage bit set. OpenClaw's ListenForMessagesAsync decoded each incoming fragment and appended it to a StringBuilder with no check on the total accumulated size, so a peer could stream continuation frames indefinitely. This is a classic CWE-770 (Allocation of Resources Without Limits or Throttling), closely related to CWE-400 (Uncontrolled Resource Consumption): there is no upper bound on how much memory a single logical message can consume. Because the .NET StringBuilder doubles its backing array as it grows, the process rapidly allocates growing contiguous buffers, and the resulting pressure terminates the node. The fix introduces a constant MaxInboundMessageChars of 32 * 1024 * 1024 (32M UTF-16 characters, roughly 64 MB) with a TryAppendWithinLimit helper that refuses the append that would breach the cap, logs a warning, and closes the socket with WebSocketCloseStatus.MessageTooBig; unit tests (WebSocketInboundLimitTests) assert that accumulation stays bounded, that legitimate sub-cap messages still pass, and that the production cap sits between 8 MB and 128 MB. The 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) and the independently assessed 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agree this is a low-complexity, network-reachable, authenticated availability-only defect.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable low-complexity flaw triggerable by a connected gateway peer (PR:L), no user interaction; impact is availability-only memory-exhaustion crash, so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes.
Articles & Coverage 1
Technical POC Analysis
CWE-770 (Allocation of Resources Without Limits or Throttling), overlapping CWE-400.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity availability flaw in OpenClaw Node for Windows allows anyone who already holds a gateway session to crash the node process by streaming malformed WebSocket continuation frames, potentially disrupting services that depend on those nodes. Because exploitation requires valid gateway credentials rather than open internet access, the realistic exposure is to insider misuse, compromised peer accounts, or lateral movement within an already-trusted gateway network. Leadership should care because sustained crashes can interrupt downstream operations and mask other malicious activity, though there is no risk of data theft or code execution.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB