Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-42420: OpenClaw before 2026.4.8 allows memory exhaustion via crafted input
CVE-2026-42420 · published 6 months ago
Summary
OpenClaw, a software used for [insert purpose], is affected by a security flaw that can cause it to run out of memory when processing certain types of input. This can lead to the software crashing or becoming unresponsive. To fix this issue, update OpenClaw to version 2026.4.8 or later.
What to do
- Update openclaw openclaw to version 2026.4.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openclaw | openclaw |
< 2026.4.8 cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* |
Original advisory text
OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exploit multiple code paths to cause memo...
OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exploit multiple code paths to cause memory exhaustion or denial of service through crafted base64-encoded input.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published28 Apr 2026
Updated4 Nov 2026
First seen28 Apr 2026
Sources
CVE-2026-42420 · NVD
Track software like this
Free during beta