Denial of Service in OpenClaw Pre-Auth Feishu Webhook Handler
CVE-2026-35665

6.9MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
10 April 2026

What is CVE-2026-35665?

OpenClaw versions prior to 2026.3.24 are susceptible to a denial of service issue due to an incomplete fix from a previous vulnerability. The application's Feishu webhook handler accepts request bodies with permissive limits, permitting unauthenticated attackers to send multiple slow HTTP POST requests. This can exhaust server connection resources, thereby blocking legitimate webhook deliveries and impacting the overall application performance.

Affected Version(s)

OpenClaw 0 < 2026.3.24

OpenClaw 2026.3.24

References

https://github.com/openclaw/openclaw/security/advisories/...
third-party-advisory
https://www.vulncheck.com/advisories/openclaw-denial-of-s...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.