A critical denial of service vulnerability in OpenClaw allows unauthenticated remote attackers to crash systems by sending oversized or slow webhook payloads.

This is a resource exhaustion flaw (CWE-770) occurring within the webhook request processing logic. Unauthenticated remote attackers can exploit this by sending malicious payloads that trigger unbounded memory allocation, leading to service degradation or failure.

Successful exploitation of this vulnerability results in a denial of service, rendering the affected webhook functionality unavailable. With a CVSS score of 7.5, this represents a significant risk to operational continuity, as attackers can disrupt critical automated workflows without needing valid credentials.

Immediate Action: Upgrade the OpenClaw package to version 2026.2.13 or later to apply the necessary request body size and time limits.

Proactive Monitoring: Monitor system memory usage and webhook processing latency to detect patterns consistent with large payload attacks or resource exhaustion attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or ingress controller to enforce strict payload size limits and request timeouts for all incoming webhook traffic.

Public Exploit Available: Unknown

Given the ease of exploitability and the potential for service disruption, administrators should prioritize updating to the patched version immediately. If an immediate update is not feasible, implementing rate limiting and request body size restrictions at the network edge is essential to minimize the risk of a successful denial of service attack.