Denial of Service Vulnerability in OpenClaw by OpenClaw
CVE-2026-42437

8.2HIGH

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
5 May 2026

What is CVE-2026-42437?

OpenClaw versions prior to 2026.4.10 are vulnerable to a denial of service attack through the voice-call realtime WebSocket path. This vulnerability allows remote attackers to exploit the lack of proper validation for oversized WebSocket frames, potentially leading to service disruptions for deployments that expose the webhook path. Organizations using affected versions should consider applying available patches to mitigate the risk and ensure uninterrupted service.

Affected Version(s)

OpenClaw 2026.4.9 < 2026.4.10

OpenClaw 2026.4.10

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/afadb7dae6738...
patch
https://www.vulncheck.com/advisories/openclaw-denial-of-s...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

G0odUser
.