Unauthenticated Resource Exhaustion in OpenClaw Voice Call Webhook

CVE-2026-35626

What is CVE-2026-35626?

OpenClaw versions prior to 2026.3.22 are susceptible to an unauthenticated resource exhaustion vulnerability in their voice call webhook implementation. This issue allows malicious actors to send oversized or crafted webhook requests that can overwhelm server resources. Specifically, the vulnerability exists because large request bodies are buffered before signature checks, enabling attackers to bypass authentication altogether. This potential exploit, if executed, can lead to significant service degradation as the server struggles to process the excessive resource demands.

References