Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

OpenClaw versions before 2026.2.14: Large responses can cause system crashes

CVE-2026-29609 GHSA-j27p-hq53-9wgc
Summary

Certain versions of OpenClaw are vulnerable to a denial of service attack that can cause system crashes. This is because the software doesn't properly handle large responses, which can lead to memory exhaustion. To fix this, update to version 2026.2.14 or later.

What to do
  • Update steipete openclaw to version 2026.2.14.
Affected software
VendorProductAffected versionsFix available
steipete openclaw <= 2026.2.14 2026.2.14
openclaw openclaw <= 2026.2.14 –
Original title
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxBytes limits. Rem...
Original description
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxBytes limits. Remote attackers can trigger memory exhaustion by serving oversized responses without content-length headers to cause availability loss.
nvd CVSS3.1 7.5
nvd CVSS4.0 8.7
Vulnerability type
CWE-770 Allocation of Resources Without Limits
CWE-400 Uncontrolled Resource Consumption
Published: 5 Mar 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026