Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
OpenClaw: Large Voice Call WebSocket Frames Can Cause Resource Consumption
GHSA-2w79-r9g8-wmcr
Summary
A medium-severity issue in OpenClaw's voice call feature allows an attacker to cause resource consumption by sending large WebSocket frames before they are fully validated. This issue affects versions of OpenClaw up to 2026.3.28, but is fixed in version 2026.3.31. Update to the latest version to resolve the issue.
What to do
- Update openclaw to version 2026.3.31.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| – | openclaw | <= 2026.3.28 | 2026.3.31 |
Original title
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)
Original description
## Summary
Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before start validation
## Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 still parses oversized pre-start voice-call WebSocket frames before start validation, and the unreleased maxPayload fix confirms the shipped resource-consumption bug remains open.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`
## Fix Commit(s)
- `9abcfdadf591bf266d85fbdfe14ae833e557a110` — 2026-03-31T19:47:10+09:00
OpenClaw thanks @Kazamayc for reporting.
Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before start validation
## Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 still parses oversized pre-start voice-call WebSocket frames before start validation, and the unreleased maxPayload fix confirms the shipped resource-consumption bug remains open.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`
## Fix Commit(s)
- `9abcfdadf591bf266d85fbdfe14ae833e557a110` — 2026-03-31T19:47:10+09:00
OpenClaw thanks @Kazamayc for reporting.
ghsa CVSS4.0
6.9
Vulnerability type
CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits
Published: 3 Apr 2026 · Updated: 3 Apr 2026 · First seen: 3 Apr 2026