Improper Input Validation in OpenClaw Affects Memory Management
CVE-2026-42420

5.3MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
28 April 2026

What is CVE-2026-42420?

OpenClaw prior to version 2026.4.8 exhibits a vulnerability characterized by improper input validation during base64 decoding operations. This issue can lead to memory exhaustion and potential denial of service as it allocates memory without enforcing limits on the decoded size. Attackers can exploit this flaw by submitting crafted base64-encoded data, triggering memory allocation issues across multiple code paths.

Affected Version(s)

OpenClaw 0 < 2026.4.8

OpenClaw 2026.4.8

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/d7c3210cd6f5f...
patch
https://www.vulncheck.com/advisories/openclaw-improper-ba...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zsx (@zsxsoft)
KeenSecurityLab
.