An unauthenticated resource exhaustion vulnerability in OpenClaw allows remote attackers to disrupt service availability by overwhelming WebSocket connections.

The application fails to implement proper resource throttling for WebSocket upgrades, allowing unauthenticated attackers to consume all available socket and worker capacity.

Successful exploitation of this flaw leads to a denial of service, rendering the affected application unavailable to legitimate users. With a CVSS score of 7.5, this vulnerability represents a high risk to business continuity, particularly for services that rely on real-time WebSocket communication for core operations.

Immediate Action: Update the OpenClaw package to version 2026.3.28 or later to implement necessary resource limits.

Proactive Monitoring: Monitor server resource utilization, specifically tracking active WebSocket connection counts and worker thread saturation levels for anomalous spikes.

Compensating Controls: Deploy a Web Application Firewall or load balancer capable of rate-limiting incoming WebSocket upgrade requests to prevent resource exhaustion from unauthenticated sources.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for significant service disruption, organizations should prioritize upgrading to version 2026.3.28 immediately. If an immediate update is not feasible, implement strict connection rate limiting at the network perimeter to mitigate the risk of resource exhaustion.