GHSA-w2cg-vxx6-5xjg

Source

https://github.com/advisories/GHSA-w2cg-vxx6-5xjg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w2cg-vxx6-5xjg/GHSA-w2cg-vxx6-5xjg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w2cg-vxx6-5xjg

Aliases

CVE-2026-29612

Published

2026-02-18T00:52:36Z

Modified

2026-03-06T01:16:35Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks

Details

Summary

Base64-backed media inputs could be decoded into Buffers before enforcing decoded-size budgets. An attacker supplying oversized base64 payloads can force large allocations, causing memory pressure and denial of service.

Attack Scenario Notes

Recommended deployments bind the gateway to loopback by default and require gateway auth for HTTP endpoints. In that configuration, this is best modeled as a local/authorized DoS.
If an operator exposes the gateway to untrusted networks (or disables/weakens auth and rate limits), treat this as a higher-severity network DoS risk.

Affected Packages / Versions

openclaw (npm): <= 2026.2.13
clawdbot (npm): <= 2026.1.24-3

Fixed In

openclaw (npm): 2026.2.14 (planned)
clawdbot (npm): no patched release planned; migrate to openclaw

Fix Commit(s)

31791233d60495725fa012745dde8d6ee69e9595

Credits

Thanks @vincentkoc for reporting.

Database specific

{
    "cwe_ids":  [
        "CWE-400",
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-18T00:52:36Z",
    "nvd_published_at":  "2026-03-05T22:16:24Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2026.2.14

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w2cg-vxx6-5xjg/GHSA-w2cg-vxx6-5xjg.json"

npm / clawdbot

Package

Name: clawdbot; View open source insights on deps.dev
Purl: pkg:npm/clawdbot

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2026.1.24-3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w2cg-vxx6-5xjg/GHSA-w2cg-vxx6-5xjg.json"