GitStock

openclaw/openclaw · Security

OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)

Open GitHub
GHSA ID
GHSA-2w79-r9g8-wmcr
CVE ID
CVE-2026-41400
Severity
medium
Published
Updated
CVSS
5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v3
5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Description

Summary

Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before start validation

Current Maintainer Triage

  • Normalized severity: medium
  • Assessment: v2026.3.28 still parses oversized pre-start voice-call WebSocket frames before start validation, and the unreleased maxPayload fix confirms the shipped resource-consumption bug remains open.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published npm version: 2026.3.31
  • Vulnerable version range: <=2026.3.28
  • Patched versions: >= 2026.3.31
  • First stable tag containing the fix: v2026.3.31

Fix Commit(s)

  • 9abcfdadf591bf266d85fbdfe14ae833e557a110 — 2026-03-31T19:47:10+09:00

OpenClaw thanks @Kazamayc for reporting.

CWEs

  • CWE-400 · Uncontrolled Resource Consumption
  • CWE-770 · Allocation of Resources Without Limits or Throttling

References