In breve
- CVE-2026-28461 è una vulnerabilità ALTO (CVSS 7.5) che riguarda openclaw (openclaw), openclaw.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.36%, superiore al 29.9% delle vulnerabilità.
- Correzione: aggiornare a 2026.3.1 o successiva.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.1
| 2026.3.1
|
| openclaw npm | < 2026.3.1
| 2026.3.1
|
Description
Summary
Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route.
Impact
An attacker could cause memory pressure and potential process instability or OOM, degrading availability.
Fix
Webhook security tracking now normalizes keys to matched webhook path semantics (query excluded) and bounds/prunes tracking state to prevent unbounded growth.
Affected and Patched Versions
- Affected:
<= 2026.2.26
- Patched:
2026.3.1
NVD description
OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different query parameters to cause memory pressure, process instability, or out-of-memory conditions that degrade service availability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free