CVE-2026-35626
mediumOpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provi…
Vendor / product: Openclaw — openclaw
OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation.
CVSS
5.3
5.3 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-04-09 22:16
Modified: 2026-11-11 23:10
NVD status: Analyzed
Last synced 3 hours ago
Verified against the source API 2026-11-11 23:12 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
openclaw / openclaw <2026.3.22
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 disclosure@vulncheck.com
- https://github.com/openclaw/openclaw/commit/651dc7450b68a5396a009db78ef9382633707ead disclosure@vulncheck.com
- https://github.com/openclaw/openclaw/security/advisories/GHSA-rm59-992w-x2mv disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/openclaw-unauthenticated-resource-exhaustion-via-voic... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-11 23:12 UTC · record ↗