Resource Exhaustion Vulnerability in OpenClaw Gateway Listener

CVE-2026-100558

What is CVE-2026-100558?

OpenClaw versions prior to 2026.8.1 are susceptible to a resource exhaustion vulnerability in the Gateway listener. This issue allows unauthenticated attackers to send malformed WebSocket upgrade requests, which do not align with the expected connection semantics. By exploiting this vulnerability, malicious users can retain response sockets and exhaust listener resources, potentially leading to a denial of service. This flaw does not require authentication and undermines the stability of the server, making it critical for users to update to the latest version to ensure protection against such attacks.

References