| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.2.22 | 2026.2.22 |
| openclaw | < 2026.2.22 | 2026.2.22 |
OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection.
openclaw (npm)<= 2026.2.21-2 (latest published at triage time)2026.2.22 (planned next release)An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads.
73d93dee64127a26f1acd09d0403b794cdeb4f5cpatched_versions is pre-set to the planned next release (2026.2.22). After that npm release is published, this advisory can be published without further version-field edits.
OpenClaw thanks @tdjackey for reporting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free