A critical resource exhaustion vulnerability in OpenClaw allows unauthenticated attackers to cause a denial of service by flooding the webhook endpoint with large, unvalidated requests.

This vulnerability, categorized as CWE-770, occurs because the application processes and buffers incoming Telegram webhook request bodies before performing any authentication checks. An unauthenticated attacker can exploit this by sending large, specially crafted POST requests to force excessive memory consumption, socket utilization, and CPU cycles dedicated to JSON parsing.

The vulnerability carries a CVSS score of 7.5, indicating a high risk of service disruption. Successful exploitation allows an attacker to render the application unresponsive, leading to significant downtime for critical business processes that rely on Telegram webhook integrations. This impact could result in service outages, data processing delays, and potential degradation of overall system stability.

Immediate Action: Update the OpenClaw package to version 2026.3.13 or later to ensure that authentication headers are validated prior to request buffering.

Proactive Monitoring: Monitor server resource utilization, specifically memory usage and process count, to identify anomalous spikes that may indicate an ongoing denial of service attempt.

Compensating Controls: Implement a Web Application Firewall (WAF) or rate-limiting middleware to restrict the size and frequency of incoming POST requests to the webhook endpoint while the update is pending.

Public Exploit Available: Unknown

Given the potential for complete service disruption, organizations should prioritize upgrading OpenClaw to version 2026.3.13 immediately. While there is no current evidence of active exploitation, the simplicity of the attack vector makes it a high-priority target for automated scanning and denial of service attacks. Applying the vendor-supplied patch is the only definitive way to eliminate the underlying resource management flaw.