What’s Vulnerable › Vulnerabilities

CVE-2026-35633: OpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-06-17
• Weakness: CWE-789

Description

OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate unbounded memory before failure handling occurs.

Affected products

• OpenClaw: before 2026.3.22 — fixed in 2026.3.22

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.22. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
• https://github.com/openclaw/openclaw/commit/81445a901091a5d27ef0b56fceedbe4724566438
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw
• https://www.vulncheck.com/advisories/openclaw-unbounded-memory-allocation-via-remote-media-error-responses

Get alerted when CVE-2026-35633 or the next vulnerability affects your stack