An unauthenticated remote denial of service vulnerability in OpenClaw allows attackers to cause memory exhaustion through malicious webhook query parameters.

The vulnerability is an allocation of resources without limits (CWE-770) located in the Zalo webhook endpoint, which permits unauthenticated attackers to force in-memory key accumulation via manipulated query strings.

Successful exploitation results in significant memory pressure, leading to process instability or out-of-memory crashes that degrade service availability. Given the CVSS score of 7.5, this high-severity flaw poses a direct threat to business continuity, as it allows external actors to disrupt critical application services without requiring prior authentication.

Immediate Action: Update OpenClaw to version 2026.3.1 or later to implement necessary memory allocation limits on the Zalo webhook endpoint.

Proactive Monitoring: Monitor server memory utilization metrics and review application logs for high frequencies of incoming requests containing diverse, randomized query string parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter or rate-limit requests directed at the Zalo webhook endpoint, specifically targeting patterns that utilize excessive or unusual query string combinations.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

This vulnerability presents a clear risk to service uptime, as it can be exploited by any unauthenticated remote attacker. Organizations running OpenClaw should prioritize the update to version 2026.3.1 immediately to prevent potential denial of service attacks that could take systems offline.