CVE-2026-28461

EUVD-2026-13014 · Published Mar 19, 2026

OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different query parameters to cause memory pressure, process instability, or out-of-memory conditions that degrade service availability.

Technologies

Openclaw Openclaw

Weaknesses

CWE-770

CVSS scores

v4.08.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
v3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Impact

T1190Exploit Public-Facing Application T1498.001Direct Network Flood T1498.002Reflection Amplification T1499Endpoint Denial of Service T1499.001OS Exhaustion Flood T1499.002Service Exhaustion Flood T1499.003Application Exhaustion Flood

References

Potentially impacted assets

See if this affects your attack surface