Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Old OpenClaw Webhooks Can Crash with Big or Slow Messages

CVE-2026-32011 · published 7 months ago
Summary

Old versions of OpenClaw are vulnerable to crashes from big or slow messages in webhooks for BlueBubbles and Google Chat. This is a concern because it could make your service unavailable. Update to version 2026.3.2 or later to fix the issue.

Original advisory text
OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies before performing authentication and sign...
OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies before performing authentication and signature validation. Unauthenticated attackers can exploit this by sending slow or oversized request bodies to exhaust parser resources and degrade service availability.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published19 Mar 2026
Updated4 Nov 2026
First seen19 Mar 2026
Sources
CVE-2026-32011 · NVD
Track software like this
Free during beta