GHSA-rxxp-482v-7mrh

Suggest an improvement
Source
https://github.com/advisories/GHSA-rxxp-482v-7mrh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rxxp-482v-7mrh/GHSA-rxxp-482v-7mrh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rxxp-482v-7mrh
Aliases
Downstream
Published
2026-03-02T22:32:55Z
Modified
2026-03-30T13:49:36.834846Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels
Details

Summary

OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.21-2 (latest published at triage time)
  • Fixed in: 2026.2.22 (planned next release)

Impact

An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads.

Fix Commit(s)

  • 73d93dee64127a26f1acd09d0403b794cdeb4f5c

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.22). After that npm release is published, this advisory can be published without further version-field edits.

OpenClaw thanks @tdjackey for reporting.

Database specific 
{
    "nvd_published_at": null,
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "github_reviewed_at": "2026-03-02T22:32:55Z"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.2.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rxxp-482v-7mrh/GHSA-rxxp-482v-7mrh.json"