CVE-2026-29609
OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch
- State
- Published
- Severity
- 8.7 High
- Published
- Mar 5, 2026
- Updated
- Mar 9, 2026
- Reserved
- Mar 4, 2026
Description
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxBytes limits. Remote attackers can trigger memory exhaustion by serving oversized responses without content-length headers to cause availability loss.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
OpenClawOpenClaw |
|
References
- GitHub Security Advisory (GHSA-j27p-hq53-9wgc)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetchthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.