GHSA-rm59-992w-x2mv

Suggest an improvement
Source
https://github.com/advisories/GHSA-rm59-992w-x2mv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rm59-992w-x2mv/GHSA-rm59-992w-x2mv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rm59-992w-x2mv
Aliases
  • CVE-2026-35626
Downstream
Published
2026-03-26T19:50:41Z
Modified
2026-04-10T20:34:52.461004Z
Severity
  • 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling
Details

Summary

Voice Call webhook handling buffered request bodies before provider signature checks, enabling bounded unauthenticated resource exhaustion.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: < 2026.3.22
  • Fixed: >= 2026.3.22
  • Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
  • Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

  • 651dc7450b68a5396a009db78ef9382633707ead

Release Status

The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

  • extensions/voice-call/src/webhook.ts now enforces header gating and shared pre-auth body caps before reading attacker-controlled request bodies.
  • extensions/voice-call/src/webhook.test.ts ships regression coverage for missing-signature, oversize, and timeout pre-auth webhook cases.

OpenClaw thanks @SEORY0 for reporting.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T19:50:41Z",
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "MODERATE",
    "nvd_published_at": null
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.3.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rm59-992w-x2mv/GHSA-rm59-992w-x2mv.json"