EUVD-2026-25318
GHSA-72fj-c222-7598
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity, unauthenticated availability-only DoS; I treat the attacker's own upload as the trigger (UI:N), though vendor UI:P would justify UI:R.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.31.
DescriptionCVE.org
OpenClaw before 2026.3.31 contains a decompression bomb vulnerability in image processing that fails to properly enforce pixel-limit guards on sips. Attackers can exploit this by uploading oversized images to cause denial of service through excessive memory consumption.
AnalysisAI
Denial of service in OpenClaw before 2026.3.31 lets remote attackers exhaust image-gateway memory by submitting a decompression bomb - a tiny compressed image that decodes to an enormous pixel count. The pixel-limit guard fails open on the sips backend, so oversized images are decoded before any size check runs. EPSS is very low (0.03%, 9th percentile) and there is no public exploit identified at time of analysis; a vendor patch (2026.3.31) is available.
Technical ContextAI
OpenClaw is an npm-distributed media/image-processing service that normalizes and resizes uploaded images through pluggable backends (sharp, and Apple's 'sips' command-line tool when preferred). The flaw is a classic decompression bomb: image formats like PNG, GIF, and WebP store dimensions in a small header, so a few kilobytes can declare millions of pixels that expand to gigabytes of raw bitmap once decoded. This maps to CWE-636 (Not Failing Securely / 'failing open'): the pixel-count guard was not enforced consistently across backends, and specifically the sips path did not reject or even determine dimensions before decode/resize work began, allowing memory exhaustion. The CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covers all versions up to the fix. The patch (commit 0ed4f8a) introduces MAX_IMAGE_INPUT_PIXELS = 25,000,000, wires limitInputPixels into the sharp backend, adds header-parsing metadata readers for PNG/GIF/WebP, and makes the sips path fail closed when dimensions cannot be determined.
RemediationAI
Vendor-released patch: upgrade the openclaw npm package to 2026.3.31 or later (first stable tag containing the fix is v2026.3.31), which enforces MAX_IMAGE_INPUT_PIXELS (25,000,000 pixels) before metadata and resize backends run and makes the sips path fail closed when dimensions cannot be determined. Apply via the fix commit 0ed4f8a72bb140045962e97ab01c94c076b758a4 and follow the advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-w85g-3h6x-4xh2. If you cannot upgrade immediately, compensating controls include: enforce a strict maximum upload byte-size and reject requests above it at the reverse proxy/API gateway (trade-off: does not stop small-but-high-pixel bombs, so pair with a decoded-pixel or dimension cap); prefer the sharp backend over sips by not setting OPENCLAW_IMAGE_BACKEND=sips (trade-off: sharp still needs the pixel guard, but sharp supports limitInputPixels natively); constrain per-request memory/CPU via container cgroup limits and add per-source rate limiting on the image endpoint (trade-off: an attacker can still degrade throughput within limits). Restrict the image-upload endpoint to authenticated or trusted callers where feasible to shrink the attack surface.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-636 – Not Failing Securely ('Failing Open')
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today