Is there a patch available for EUVD-2026-21136?

Yes, a patch is available for EUVD-2026-21136. Update the affected software to the latest version immediately.

Openclaw EUVD-2026-21136

Q: What is the CVSS score of EUVD-2026-21136?

EUVD-2026-21136 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-35640 MEDIUM

Incorrect Behavior Order (CWE-696)

2026-04-09 VulnCheck

GHSA-8f9r-gr6r-x63q

Denial Of Service Openclaw

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 21:45 euvd

EUVD-2026-21136

Analysis Generated

Apr 09, 2026 - 21:45 vuln.today

Patch released

Apr 09, 2026 - 21:45 nvd

Patch available

CVE Published

Apr 09, 2026 - 21:27 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing before signature rejection.

AnalysisAI

OpenClaw before version 2026.3.25 processes JSON webhook request bodies before validating cryptographic signatures, allowing unauthenticated remote attackers to trigger denial of service by submitting malicious webhook payloads that force computationally expensive JSON parsing operations. The vulnerability exploits a logic-ordering defect where signature validation occurs after resource-intensive parsing, enabling attackers to exhaust server resources without valid credentials. No public exploit code has been identified at the time of analysis, though the attack requires only network access and is trivially exploitable.

Technical ContextAI

OpenClaw is a webhook processing system that validates incoming webhook requests via cryptographic signatures (likely HMAC-based given the context). The vulnerability stems from CWE-696 (Incorrect Behavior Order), a class of flaws where security checks are performed in the wrong sequence. The root cause is architectural: the application parses incoming JSON request bodies into memory and processes them (potentially with schema validation, deserialization, or traversal) before checking the webhook signature. An attacker can craft deeply nested JSON structures, extremely large payloads, or computationally expensive JSON documents that consume CPU and memory during parsing. When the signature validation subsequently fails, the already-expended resources are wasted. This is a classic example of order-of-operations vulnerability in authentication frameworks. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) in all versions before 2026.3.25.

RemediationAI

Vendor-released patch: OpenClaw 2026.3.25 or later. Users should upgrade immediately via the official release channels. The upstream fix is confirmed in commit 5e8cb22176e9235e224be0bc530699261eb60e53 (https://github.com/openclaw/openclaw/commit/5e8cb22176e9235e224be0bc530699261eb60e53), which reorders webhook processing logic to validate signatures before parsing JSON request bodies. As a temporary mitigation, if upgrade is not immediately feasible, configure network-level rate limiting or firewall rules to restrict webhook endpoint access to known sender IP addresses or implement request size limits to constrain resource exhaustion potential. However, these workarounds do not eliminate the vulnerability and should not substitute for patching.