What is the CVSS score of CVE-2026-28461?

CVE-2026-28461 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-28461?

OpenClaw deployments are vulnerable to denial-of-service attacks that can crash services by exhausting system memory through the Zalo webhook endpoint.. A patch is available.

How to fix or mitigate CVE-2026-28461?

Within 24 hours: Inventory all OpenClaw instances and confirm version numbers; disable or restrict access to the Zalo webhook endpoint if not actively used. Within 7 days: Implement Web Application Firewall (WAF) rules to rate-limit and validate webhook requests; enable query parameter filtering. Within 30 days: Upgrade to OpenClaw version 2026.3.1 or later when the patch becomes available; validate the fix in a test environment before production deployment.

Openclaw CVE-2026-28461

EUVD-2026-13014 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-19 VulnCheck

Denial Of Service Openclaw

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

EUVD ID Assigned

Mar 19, 2026 - 01:30 euvd

EUVD-2026-13014

Analysis Generated

Mar 19, 2026 - 01:30 vuln.today

CVE Published

Mar 19, 2026 - 01:00 nvd

HIGH 7.5

DescriptionCVE.org

OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different query parameters to cause memory pressure, process instability, or out-of-memory conditions that degrade service availability.

AnalysisAI

OpenClaw contains an unbounded memory growth vulnerability in its Zalo webhook endpoint that allows unauthenticated remote attackers to exhaust system memory through query string manipulation. OpenClaw versions prior to 2026.3.1 are affected. Attackers can send repeated HTTP requests with varying query parameters to trigger in-memory key accumulation, leading to memory pressure, process instability, or complete denial of service through out-of-memory conditions.

Technical ContextAI

This vulnerability affects OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), specifically the Zalo webhook endpoint implementation. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), where the application fails to bound the number of unique query string keys stored in memory. When processing webhook requests, the endpoint accumulates dictionary keys or cache entries based on query parameters without implementing size limits, expiration policies, or rate limiting. This architectural flaw in resource management allows attackers to cause unbounded memory consumption by systematically varying query string parameters across multiple requests, eventually exhausting available memory.

RemediationAI

Upgrade OpenClaw to version 2026.3.1 or later immediately, as documented in the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh. Until patching is completed, implement temporary mitigations including rate limiting on the Zalo webhook endpoint at the reverse proxy or web application firewall level, restricting access to the webhook endpoint to known Zalo server IP addresses only, and implementing memory monitoring with automatic process restart thresholds to limit impact. Additionally, consider deploying query string normalization rules that strip or limit the number of unique query parameters accepted by the webhook endpoint to prevent key accumulation attacks.