GitHub Advisoryadvisory · npm

GHSA-f44p-c7w9-7xr7 OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades

MEDIUM Published 2026-03-31 Modified 2026-04-28 Official page ↗
Aliases
CVE-2026-41399
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-400, CWE-770
Reviewed
2026-03-31

Affected packages

• npm openclaw: < 2026.3.28 → fixed in 2026.3.28

Description

Summary The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget. Impact An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients. Affected Component `src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.ts` Fixed Versions • Affected: `= 2026.3.28` • Latest stable `2026.3.28` contains the fix. Fix Fixed by commit `cb5f7e201f` (`gateway: cap concurrent pre-auth websocket upgrades`). Discovered by：Topsec AlphaLab (wang dong)

Related

Alias · CVE (1)

  • CVE-2026-41399 OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References