Openclaw EUVD-2026-21476

CVSS 5.3 (Medium, AV:N/AC:L) reflects a network-exploitable, low-complexity denial of service with limited impact (availability only; no confidentiality or integrity breach). The attack vector is straightforward (network, no authentication required, no user interaction), but the impact is bounded to service availability. However, context matters: this is an incomplete fix to a prior vulnerability (CVE-2026-32011), indicating that the vendor's initial remediation was insufficient and this issue may remain in production deployments for extended periods. The lack of computational complexity (AC:L) and lack of privileges required (PR:N, UI:N) mean any remote attacker can mount this attack immediately. While CVSS is moderate, the real-world risk depends on the criticality of webhook delivery in the target environment-for organizations relying on real-time Feishu notifications (DevOps alerts, incident response), prolonged webhook unavailability could cascade into operational impact. No EPSS score, KEV status, or public POC data were provided, but the attack is trivial to execute (standard HTTP client, no special tools needed), suggesting practical exploitability is high despite moderate CVSS.

An attacker identifies the OpenClaw Feishu webhook endpoint (commonly at a predictable path such as /webhook/feishu or /api/webhooks/feishu) and writes a simple Python or curl script that opens hundreds of concurrent TCP connections and sends partial or slow HTTP POST requests with large bodies (e.g., Content-Length: 1048576) without completing the transmission, holding each connection open for 25-30 seconds. The OpenClaw server allocates buffers and connection state for each request, consuming memory and file descriptors. Because signature verification does not occur until the full body is received or the timeout expires, the attacker exhausts server resources without needing valid credentials. Within minutes, the server hits connection or memory limits, and legitimate Feishu webhooks (e.g., incident notifications from monitoring systems) are dropped or delayed, causing blind spots in alerting and incident response. The attack requires only basic HTTP knowledge and no special tools, making it practical for any unauthenticated attacker on the internet.