En bref
- CVE-2026-41400 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant openclaw (openclaw), openclaw.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.53%, plus élevée que 44.6% des vulnérabilités.
- Correctif : mettre à jour vers 2026.3.31 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before start validation
Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 still parses oversized pre-start voice-call WebSocket frames before start validation, and the unreleased maxPayload fix confirms the shipped resource-consumption bug remains open.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
9abcfdadf591bf266d85fbdfe14ae833e557a110 — 2026-03-31T19:47:10+09:00
OpenClaw thanks @Kazamayc for reporting.
NVD description
OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. Remote attackers can send oversized pre-start WebSocket frames to cause resource consumption and denial of service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free