GitHub Advisoryadvisory · npm

GHSA-wr6m-jg37-68xh OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)

MEDIUM Published 2026-03-02 Modified 2026-03-23 Official page ↗
Aliases
CVE-2026-32066
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-400
Reviewed
2026-03-02

Affected packages

• npm openclaw: < 2026.3.1 → fixed in 2026.3.1

Description

Summary Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route. Impact An attacker could cause memory pressure and potential process instability or OOM, degrading availability. Fix Webhook security tracking now normalizes keys to matched webhook path semantics (query excluded) and bounds/prunes tracking state to prevent unbounded growth. Affected and Patched Versions • Affected: `<= 2026.2.26` • Patched: `2026.3.1`

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References