A denial of service vulnerability in OpenClaw allows remote unauthenticated attackers to trigger service unavailability by sending oversized WebSocket frames.

This is a resource consumption flaw involving the allocation of resources without limits or throttling, occurring within the voice-call realtime WebSocket path and requiring no authentication.

A successful exploitation of this vulnerability leads to complete service unavailability for affected deployments. This disruption halts critical voice-call functionalities, directly impacting operational continuity and user communication. The associated CVSS score of 7.5 reflects a high severity risk due to the ease of remote exploitation and the potential for significant system downtime.

Immediate Action: Update npm package openclaw to version 2026.4.10 or later.

Proactive Monitoring: Monitor WebSocket connection rates and resource utilization on the voice-call realtime path for anomalous spikes.

Compensating Controls: Implement rate limiting and maximum frame size restrictions at the reverse proxy or Web Application Firewall layer.

Public Exploit Available: No (no confirmed public exploit in available data)

Given the high severity and potential for immediate denial of service, administrators must apply the security update to version 2026.4.10 without delay. Ensuring proper input validation on WebSocket frames is vital for maintaining service reliability.