| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.1 | 2026.3.1 |
| openclaw | < 2026.3.1 | 2026.3.1 |
Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route.
An attacker could cause memory pressure and potential process instability or OOM, degrading availability.
Webhook security tracking now normalizes keys to matched webhook path semantics (query excluded) and bounds/prunes tracking state to prevent unbounded growth.
<= 2026.2.262026.3.1Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free