What’s Vulnerable › Vulnerabilities

CVE-2026-41343: OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-23 · updated 2026-06-17
• Weakness: CWE-799

Description

OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss. Remote attackers can flood the webhook endpoint with concurrent requests before signature verification to exhaust resources and degrade service availability.

Affected products

• OpenClaw: before 2026.3.31 — fixed in 2026.3.31

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.31. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/57c47d8c7fbf5a2e70cc4dec2380977968903cad
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qcc3-jqwp-5vh2
• https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-line-webhook-handler-pre-auth-concurrency

Get alerted when CVE-2026-41343 or the next vulnerability affects your stack