CVE-2026-35633
OpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses
- State
- Published
- Severity
- 6.9 Medium
- Published
- Apr 9, 2026
- Updated
- Jun 23, 2026
- Reserved
- Apr 4, 2026
Description
OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate unbounded memory before failure handling occurs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-789 Uncontrolled Memory Allocation
Affected Products
| Product | Versions |
|---|---|
OpenClawOpenClaw |
|
References
- GitHub Security Advisory (GHSA-4qwc-c7g9-4xcw)vendor-advisory
- Patch Commit #1patch
- Patch Commit #2patch
- VulnCheck Advisory: OpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responsesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.