Which versions of OpenClaw are affected by CVE-2026-42437?

OpenClaw versions prior to 2026.4.10 contain a remote denial-of-service vulnerability in the voice-call WebSocket endpoint that allows unauthenticated attackers to crash the service by sending…. A patch is available.

How to fix or mitigate CVE-2026-42437?

Within 24 hours: Inventory all OpenClaw instances and identify those running versions prior to 2026.4.10; restrict network access to the WebSocket voice-call endpoint via firewall rules if external exposure exists. Within 7 days: Deploy OpenClaw 2026.4.10 or later across all affected instances using staged testing. Within 30 days: Conduct post-patch validation and document any compensating controls that can be removed.

OpenClaw CVE-2026-42437

Q: What is the CVSS score of CVE-2026-42437?

CVE-2026-42437 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27257 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-05 VulnCheck

GHSA-vw3h-q6xq-jjm5

Denial Of Service Openclaw

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 05, 2026 - 12:53 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 05, 2026 - 12:37 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 12:37 NVD

7.5 (HIGH) 8.2 (HIGH)

Source Code Evidence Fetched

May 05, 2026 - 12:16 vuln.today

Analysis Generated

May 05, 2026 - 12:16 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.9.

DescriptionCVE.org

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the webhook path.

AnalysisAI

Remote attackers can crash OpenClaw 2026.4.9 by sending oversized WebSocket frames to the voice-call realtime webhook path, causing complete service unavailability. The vulnerability requires no authentication and affects deployments that expose the WebSocket endpoint externally. Vendor patch released in version 2026.4.10 with commit afadb7dae6738819ad9c7d2597ace0516957d20e. No active exploitation confirmed (not in CISA KEV), but public advisory with commit details provides exploitation blueprint.

Technical ContextAI

This is a CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerability in OpenClaw's WebSocket implementation for voice-call realtime communications. The affected code path processes WebSocket frames without validating frame size before resource allocation, allowing attackers to trigger memory exhaustion or processing overload through maliciously crafted oversized frames. WebSocket protocol (RFC 6455) supports frames up to 2^63-1 bytes in theory, but real-world implementations must enforce practical limits. The vulnerability specifically affects the webhook path component that handles realtime voice data streams, which typically requires low-latency processing and may lack robust input validation to minimize overhead.

RemediationAI

Upgrade to OpenClaw version 2026.4.10 or later, which implements proper WebSocket frame size validation per commit afadb7dae6738819ad9c7d2597ace0516957d20e in the GitHub repository. Review the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-vw3h-q6xq-jjm5 for complete upgrade guidance. If immediate patching is not feasible, implement compensating controls at the network layer: deploy a reverse proxy or API gateway (nginx, HAProxy, AWS ALB) configured to enforce maximum WebSocket frame size limits of 1-10MB depending on legitimate voice payload requirements, and implement rate limiting on WebSocket connections to the webhook endpoint (10-100 connections per source IP per minute). Note that frame size limits may affect legitimate large voice payloads if set too restrictively - test with typical usage patterns. Alternatively, restrict network access to the voice-call webhook path using firewall rules to allow only trusted source IPs (internal networks, known partner systems), though this reduces service availability and does not protect against insider threats or compromised trusted systems.