{"id":"CVE-2026-100558","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-100558","generatedAt":"2026-10-28T03:58:55.828Z","title":"OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics.","description":"OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth connection budget.","published":"2026-09-26T03:17:03.000Z","lastModified":"2026-09-28T18:17:13.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-400"],"affected":[],"epss":{"score":0.00278,"percentile":0.20171,"date":"2026-10-27","history":[{"date":"2026-09-26","score":0.00278,"percentile":0.18209}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-26T03:17:03.000Z","detail":{"score":"8.7","severity":"HIGH","publishedAt":"2026-09-26T03:17:02.533Z"},"summary":"New CVE, high severity (CVSS 8.7)."}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4r25-35qc-fr6j","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-resource-exhaustion-via-websocket-upgrade","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-100558","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}