Описание
OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing before signature rejection.
Ссылки
- Patch
- Vendor Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2026.3.25 (исключая)
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 37%
0.00436
Низкий
5.3 Medium
CVSS3
7.5 High
CVSS3
Дефекты
CWE-696
Связанные уязвимости
github
5 месяцев назад
OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation
EPSS
Процентиль: 37%
0.00436
Низкий
5.3 Medium
CVSS3
7.5 High
CVSS3
Дефекты
CWE-696