CVE-2026-29609

OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxBytes limits. Remote attackers can trigger memory exhaustion by serving oversized responses without content-length headers to cause availability loss.

Affected

OpenClaw

CVSS v4.0 VULNCHECK

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.79% chance of exploitation in the next 30 days, 55th percentile

Published

2026-03-05

Updated

2026-03-09

Proof-of-concept exploits (1)

• advisories/GHSA-j27p-hq53-9wgc

Security advisories

• openclaw/openclaw/security/advisories/GHSA-j27p-hq53-9wgc
• https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unbounded-url-backed-…
• openclaw/openclaw/commit/00a08908892d1743d1fc52e5cbd9499dd5da2fe0

References

• CVE Record
• NVD entry