High severity7.5NVD Advisory· Published Mar 21, 2026· Updated Jun 17, 2026

CVE-2026-32049

Description

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage and potential process instability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.2.22	2026.2.22

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.22
- (no CPE)range: 0
ghsa-coords
pkg:npm/openclaw
Range: < 2026.2.22

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/73d93dee64127a26f1acd09d0403b794cdeb4f5cnvdPatchWEB
github.com/advisories/GHSA-rxxp-482v-7mrhghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-rxxp-482v-7mrhnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-32049ghsaADVISORY
www.vulncheck.com/advisories/openclaw-denial-of-service-via-inbound-media-download-byte-limit-bypassnvdThird Party AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000