What is the CVSS score of CVE-2026-22178?

CVE-2026-22178 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-22178?

CVE-2026-22178 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-22178?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Openclaw CVE-2026-22178

EUVD-2026-12722 MEDIUM

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-03-18 VulnCheck

GHSA-c6hr-w26q-c636

Denial Of Service Openclaw

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 02:30 euvd

EUVD-2026-12722

Analysis Generated

Mar 18, 2026 - 02:30 vuln.today

Patch released

Mar 18, 2026 - 02:30 nvd

Patch available

CVE Published

Mar 18, 2026 - 01:34 nvd

MEDIUM 6.5

DescriptionCVE.org

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.

AnalysisAI

OpenClaw versions before 2026.2.19 are vulnerable to regex injection and denial of service through unescaped Feishu mention metadata in the stripBotMention function. An unauthenticated network attacker can craft malicious mention metadata containing nested-quantifier patterns or regex metacharacters to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing, with a CVSS score of 6.5 indicating medium severity with integrity and availability impact. Patch availability exists from the vendor via GitHub commits, and proof-of-concept details are available through VulnCheck advisory references.

Technical ContextAI

The vulnerability exists in OpenClaw's message processing pipeline, specifically in the stripBotMention function which handles Feishu (a collaboration platform) mention metadata. The root cause is CWE-1333 (Inefficient Regular Expression Complexity), where user-controlled input from Feishu mention metadata is directly passed to RegExp object construction without proper escaping or validation. When an attacker supplies specially crafted metacharacters or nested quantifiers (such as (a+)+b patterns), the regex engine enters a state of catastrophic backtracking, consuming excessive CPU resources and blocking the entire message processing queue. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), which integrates with Feishu as a messaging platform, making the attack vector network-accessible without authentication.

RemediationAI

Immediately upgrade OpenClaw to version 2026.2.19 or later, which includes fixes implemented in the referenced GitHub commits. Verify the patches are applied by checking commit 7e67ab75cc2f0e93569d12fecd1411c2961fcc8c and 74268489137510b6f6349919d1e197b17290d92c are included in your deployment. As an interim mitigation if immediate patching is not possible, restrict or disable Feishu mention metadata processing by rate-limiting or filtering incoming Feishu message events, and monitor CPU usage for signs of regex backtracking attacks (sustained high CPU on message processing threads). Additionally, implement network segmentation to limit which external Feishu instances can send messages to OpenClaw deployments. Refer to the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-c6hr-w26q-c636 for deployment-specific guidance.