EUVD-2026-83801
GHSA-24pq-v99h-hj63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to OpenClaw instance (PR:L)
-
DeliverySend crafted large GET to Canvas Host Route
-
ExploitServer buffers whole file via readFile()
-
ExecutionMemory/resource exhaustion
-
ImpactCanvas service degraded (VA:L)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires reaching the Canvas Host Route handled by createCanvasHostHandler in the canvas extension, which serves files by fully buffering them into memory through readFile() (serve.runtime.ts) with no streaming or size limit. The CVSS vector's PR:L indicates the attacker needs a low level of authenticated access to the OpenClaw instance rather than anonymous reach. Limiting factors: only the HTTP serve path is affected (the sibling WebSocket path already caps at 64KB), impact is confined to transient availability degradation (VA:L, no data exposure or code execution), and the affected product is a niche project with minimal deployment. |
| Impact | This is a genuinely low-priority issue, and every available signal agrees. The vendor CVSS 4.0 score is 2.1 (Low) with a vector of AV:N/AC:L/AT:N/PR:L/UI:N and impact limited to VA:L - only a partial, transient availability effect and zero confidentiality or integrity impact. The flaw is a CWE-404 resource-management defect: the Canvas Host Route's createCanvasHostHandler reads an entire file into memory via readFile() with no streaming or size cap (the promised 'streaming/size-limit' fix was never shipped in 2026.9.5), unlike the sibling WebSocket path that caps at 64KB. A publicly available exploit exists (GitHub lche511/cve, an 'OpenClaw_Canvas_Big_GET_DoS_Report'), so exploit code is available - but this must NOT be conflated with active exploitation: there is no CISA KEV listing and no EPSS score provided. The SSVC/CVSS picture is coherent (E:P proof-of-concept maturity, PR:L means it is NOT unauthenticated), and the worst realistic outcome is temporary memory/resource exhaustion of a single service instance. Bottom line: real bug, real POC, but trivial impact and low deployment footprint make this a routine-patch item, not an urgent one. |
| Exploit ScenarioDerived | A low-privileged authenticated user of an OpenClaw instance sends a manipulated request to the Canvas Host Route that causes the server to buffer an oversized file fully into memory via readFile(), exhausting resources and degrading or crashing the canvas service. A public proof-of-concept ('Big GET DoS') is available on GitHub demonstrating the technique. Because CVSS records PR:L, the attacker needs some level of authenticated access rather than pure anonymous reach. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Denial of service in OpenClaw up to and including 2026.9.5 allows a remote attacker with low-privileged authenticated access to exhaust server memory by requesting large files through the Canvas Host Route, which buffers entire files into memory via readFile() in src/canvas/serve.runtime.ts with no streaming or size cap. Publicly available exploit code exists (a PoC report is published on GitHub), but there is no indication of confirmed active exploitation (not in CISA KEV). Impact is limited to transient availability degradation of the canvas extension's HTTP serve path - no data exposure, integrity loss, or code execution - and every signal, including the assessed CVSS:3.1 vector of 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) and the vendor's CVSS 4.0 base score of 2.1, points to a genuinely low-priority issue.
RemediationAI
No vendor-released patch has been identified at time of analysis - the streaming/size-limit fix referenced in the disclosure was never shipped, and 2026.9.5 still buffers whole files through readFile() - so remediation must rely on compensating controls until an upstream release appears. First, if the canvas extension is not actively used, disable it entirely; this removes the attack surface at the cost of losing canvas functionality. If it is required, publish the Canvas Host Route only to trusted, authenticated users, since the assessed vector (PR:L) indicates low-privileged authentication is already necessary and tightening that boundary prevents the buffer-exhaustion requests from being issued. Place the instance behind a reverse proxy that enforces a strict maximum response body size and per-connection buffering limits, and cap concurrent requests to the canvas route; this trades legitimate large-file canvas serving for memory safety and will break downloads that exceed the configured ceiling. Additionally, run the Node.js process under an explicit heap limit (e.g., --max-old-space-size) and memory cgroup so an oversized request degrades a single worker rather than the host, and monitor/rate-limit repeated large GETs to the route. Watch the VulDB entries at https://vuldb.com/vuln/408023 and https://vuldb.com/cve/CVE-2026-94094 for a fixed version before assuming the issue is closed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the canvas extension of OpenClaw, a niche Node.js/TypeScript project. The Canvas Host Route is implemented by createCanvasHostHandler in extensions/canvas/src/host/server.ts, and the actual file-serving logic at src/canvas/serve.runtime.ts (lines 17 and 114) reads the requested file entirely into memory with readFile() before responding. There is no streaming, no chunked transfer, and no maximum-size guard, so repeated or concurrent GET requests for large files drive unbounded memory allocation. The root cause class is CWE-404 (Improper Resource Shutdown or Release): the allocated buffer is neither bounded nor released in a controlled way under concurrency, so memory pressure persists and can crash or stall the process. Notably, the sibling WebSocket code path already caps payloads at 64KB, so the HTTP serve path is an inconsistent, unprotected outlier. The proposed fix - streaming and enforcing a size limit - was never shipped; the latest 2026.9.5 release still calls readFile(). CPE data (cpe:2.3:a:n/a:openclaw:*:*:*:*:*:*:*:*) is a wildcard with an unassigned vendor, reflecting the project's minimal CVE/CPE footprint rather than a scoped version range.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable and low-complexity, but requires authenticated low-privilege access (PR:L) and yields only partial, recoverable availability impact (A:L) with no C/I effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion's "streaming/size-limit" was never shipped - latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve.runtime.ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB