Опубликовано: 24 апр. 2026
Источник: github
Github: Прошло ревью
CVSS4: 6.9
CVSS3: 5.3
Описание
Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6336-qqw9-v6x6. This link is maintained to preserve external references.
Original Description
OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss. Remote attackers can flood the webhook endpoint with concurrent requests before signature verification to exhaust resources and degrade service availability.
Ссылки
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qcc3-jqwp-5vh2
- https://nvd.nist.gov/vuln/detail/CVE-2026-41343
- https://github.com/openclaw/openclaw/commit/57c47d8c7fbf5a2e70cc4dec2380977968903cad
- https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-line-webhook-handler-pre-auth-concurrency
Пакеты
Наименование
openclaw
npm
Затронутые версииВерсия исправления
< 2026.3.31
2026.3.31
6.9 Medium
CVSS4
5.3 Medium
CVSS3
Дефекты
CWE-799
6.9 Medium
CVSS4
5.3 Medium
CVSS3
Дефекты
CWE-799