A critical resource exhaustion vulnerability in OpenClaw allows unauthenticated remote attackers to trigger denial of service conditions by bypassing media byte limit enforcement.

This is a resource management flaw (CWE-770) where the application fails to throttle inbound media payloads. An unauthenticated attacker can exploit this by sending oversized media packets, forcing the service to buffer data without limits, which leads to memory exhaustion and potential process crashes.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk primarily due to the potential for service disruption. Successful exploitation could result in significant system downtime, impacting availability for all users and potentially requiring manual intervention to restore service stability.

Immediate Action: Update the OpenClaw package to version 2026.2.22 or later to ensure proper inbound byte limit enforcement.

Proactive Monitoring: Monitor server memory usage and ingestion path logs for spikes in traffic or repetitive, large-payload requests that may indicate an ongoing attempt to exhaust system resources.

Compensating Controls: Implement rate limiting and payload size restrictions at the network perimeter or via a Web Application Firewall (WAF) to prevent oversized media packets from reaching the application layer.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for severe service disruption, organizations should prioritize patching their OpenClaw instances. Applying the update to version 2026.2.22 is the only definitive method to resolve the underlying resource management flaw and protect the service from potential denial of service attacks.