CVE-2026-28452

Medium CVSS: 6.7

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.

Vendor

Openclaw

Product

Openclaw

CWE

CWE-770

Yayın Tarihi

2026-03-05 22:16:17

Güncelleme

2026-03-09 18:30:09

Source Identifier

disclosure@vulncheck.com

KEV Date Added

Kategoriler

CWE-770 Openclaw MEDIUM Openclaw 2026

Referanslar

https://github.com/openclaw/openclaw/commit/5f4b29145c236d124524c2c9af0f8acd048fbdea https://github.com/openclaw/openclaw/commit/d3ee5deb87ee2ad0ab83c92c365611165423cb71 https://github.com/openclaw/openclaw/security/advisories/GHSA-h89v-j3x9-8wqj https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unguarded-archive-extraction-in-extractarchive

Benzer Kayıtlar

Medium

CVE-2026-34426

OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment varia…

High

CVE-2026-34503

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked.…

Medium

CVE-2026-34504

OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-prov…

Medium

CVE-2026-33580

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication th…

High

CVE-2026-33581

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbi…

Medium

CVE-2026-33576

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization.…