CVE-2026-35626

low-risk
Published 2026-04-09

OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation.

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Openclaw

References (4)

Patch https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171d...
Patch https://github.com/openclaw/openclaw/commit/651dc7450b68a5396a009db78ef938263370...
Vendor Advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-rm59-992w-x2mv
Third Party Advisory https://www.vulncheck.com/advisories/openclaw-unauthenticated-resource-exhaustio...
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal