요약
- CVE-2026-35626은(는) openclaw (openclaw), openclaw에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.49%, 전체 취약점의 42.5%보다 높음.
- 조치: 2026.3.22 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.22
| 2026.3.22
|
| openclaw npm | < 2026.3.22
| 2026.3.22
|
Description
Summary
Voice Call webhook handling buffered request bodies before provider signature checks, enabling bounded unauthenticated resource exhaustion.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
- Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
651dc7450b68a5396a009db78ef9382633707ead
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- extensions/voice-call/src/webhook.ts now enforces header gating and shared pre-auth body caps before reading attacker-controlled request bodies.
- extensions/voice-call/src/webhook.test.ts ships regression coverage for missing-signature, oversize, and timeout pre-auth webhook cases.
OpenClaw thanks @SEORY0 for reporting.
NVD description
OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free