En resumen
- CVE-2026-41400 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a openclaw (openclaw), openclaw.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.53%, mayor que el 44.5% de las vulnerabilidades.
- Solución: actualizar a 2026.3.31 o posterior.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before start validation
Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 still parses oversized pre-start voice-call WebSocket frames before start validation, and the unreleased maxPayload fix confirms the shipped resource-consumption bug remains open.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
9abcfdadf591bf266d85fbdfe14ae833e557a110 — 2026-03-31T19:47:10+09:00
OpenClaw thanks @Kazamayc for reporting.
NVD description
OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. Remote attackers can send oversized pre-start WebSocket frames to cause resource consumption and denial of service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free