CVE-2026-29609
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxBytes limits.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxBytes limits. Remote attackers can trigger memory exhaustion by serving oversized responses without content-length headers to cause availability loss.
- CVSS 4.0
- 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.43% probability · 36th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- openclaw/openclaw
- Source
- disclosure@vulncheck.com
References
- https://github.com/openclaw/openclaw/commit/00a08908892d1743d1fc52e5cbd9499dd5da2fe0Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-j27p-hq53-9wgcVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unbounded-url-backed-media-fetchThird Party Advisory
- https://github.com/openclaw/openclaw/security/advisories/GHSA-j27p-hq53-9wgcVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.