Kurz gesagt
- CVE-2026-41400 ist eine Schwachstelle (HOCH (CVSS 7.5)) in openclaw (openclaw), openclaw.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.53%, höher als bei 44.6% aller Schwachstellen.
- Abhilfe: auf 2026.3.31 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before start validation
Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 still parses oversized pre-start voice-call WebSocket frames before start validation, and the unreleased maxPayload fix confirms the shipped resource-consumption bug remains open.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
9abcfdadf591bf266d85fbdfe14ae833e557a110 — 2026-03-31T19:47:10+09:00
OpenClaw thanks @Kazamayc for reporting.
NVD description
OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. Remote attackers can send oversized pre-start WebSocket frames to cause resource consumption and denial of service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free