A memory exhaustion vulnerability in OpenClaw allows unauthenticated remote attackers to cause a denial of service by sending specifically crafted, oversized responses.

The application fails to enforce size constraints on incoming payloads within the fetchWithGuard function, leading to resource exhaustion. This flaw is remotely exploitable by unauthenticated attackers, as the memory allocation occurs before maxBytes limits are applied.

Successful exploitation of this vulnerability results in a denial of service, rendering the affected OpenClaw instance unavailable to legitimate users. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to service continuity and operational stability. Organizations relying on OpenClaw for critical data processing should prioritize remediation to prevent potential service disruptions.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later to implement the necessary memory allocation constraints.

Proactive Monitoring: Monitor server memory utilization and application logs for abnormal spikes or service crashes associated with the fetchWithGuard function.

Compensating Controls: Deploy a Web Application Firewall (WAF) or load balancer configured to inspect and limit the size of incoming HTTP responses before they reach the application.

Public Exploit Available: Unknown.

Given the high severity of this denial of service vulnerability and its potential impact on system availability, administrators must prioritize the update to version 2026.2.14. Organizations should verify their dependency trees to ensure the patch is applied across all environments and continue monitoring for unusual traffic patterns that may indicate attempts to trigger memory exhaustion.