What is the CVSS score of CVE-2026-32066?

CVE-2026-32066 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

How to fix or mitigate CVE-2026-32066?

Within 24 hours: Identify all OpenClaw instances in production and determine affected versions; assess whether Zalo webhook functionality is actively used. Within 7 days: Implement network-level rate limiting on the webhook endpoint, enable WAF rules to block suspicious query string variations, and isolate webhook processing to a dedicated resource pool with memory limits. Within 30 days: Evaluate upgrade path to version 2026.3.1 or later when patch becomes available; if upgrade is not feasible, consider disabling the Zalo webhook feature entirely if business requirements permit.

Openclaw CVE-2026-32066

Q: Which versions of Openclaw are affected by CVE-2026-32066?

OpenClaw versions prior to 2026.3.1 contain a critical denial-of-service vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to crash services by exhausting server…. A patch is available.

EUVD-2026-14565 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-23 VulnCheck

Denial Of Service Openclaw

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 23, 2026 - 22:00 euvd

EUVD-2026-14565

Analysis Generated

Mar 23, 2026 - 22:00 vuln.today

CVE Published

Mar 23, 2026 - 21:36 nvd

HIGH 7.5

DescriptionCVE.org

OpenClaw before 2026.3.1 contains an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger memory exhaustion by varying query strings. Attackers can send repeated requests with different query parameters to the same webhook route, causing unbounded in-memory key accumulation that leads to memory pressure, process instability, or out-of-memory conditions.

AnalysisAI

OpenClaw contains an unbounded memory growth vulnerability in its Zalo webhook endpoint that enables unauthenticated remote attackers to exhaust server memory by sending repeated HTTP requests with varying query string parameters. This affects OpenClaw versions prior to 2026.3.1. The vulnerability has a CVSS score of 7.5 (High) due to its network accessibility and lack of authentication requirements, though no evidence of active exploitation (KEV) or public proof-of-concept has been identified at this time.

Technical ContextAI

The vulnerability exists in OpenClaw (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), specifically affecting the Zalo webhook endpoint implementation. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), where the application fails to implement proper bounds on in-memory key storage for incoming webhook requests. When the webhook endpoint receives requests with different query string parameters, each unique query parameter combination creates a new entry in an unbounded in-memory cache or dictionary structure. This architectural flaw allows attackers to force the application to continuously allocate memory for new keys without any eviction policy, garbage collection threshold, or rate limiting mechanism to prevent resource exhaustion.

RemediationAI

Upgrade OpenClaw to version 2026.3.1 or later, which addresses the unbounded memory growth issue in the Zalo webhook endpoint. Consult the official GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh for complete patch information and release notes. As an interim mitigation if immediate patching is not feasible, implement rate limiting at the reverse proxy or web application firewall level specifically for the Zalo webhook endpoint route, restrict access to the webhook endpoint by IP address to only trusted Zalo service ranges, and configure memory limits and monitoring alerts for the OpenClaw process to detect abnormal memory growth patterns. Organizations not using Zalo webhook functionality should consider disabling or removing this endpoint entirely to eliminate the attack surface.