cve.bz

CVE-2026-35633

6.9 mediumEPSS 0.4%

Medium (6.9) in openclaw openclaw. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in openclaw 2026.3.22.

OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate unbounded memory before failure handling occurs.

Severity

CVSS 4.0

6.9 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS
0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWEs
CWE-770, CWE-789
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4qwc-c7g9-4xcwnpmopenclaw<2026.3.222026.3.22

References

Check your stackJSON