| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget.
An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients.
src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit cb5f7e201f (gateway: cap concurrent pre-auth websocket upgrades).
Discovered by：Topsec AlphaLab (wang dong)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free