CVE-2026-29612

MEDIUM

OpenClaw <2026.2.14 - DoS

Title source: llm

Description

OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.

References (3)

[Patch] https://github.com/openclaw/openclaw/commit/31791233d60495725fa012745dde8d6ee69e9595

View Patch ZIP pw:eip

[Vendor Advisory] https://github.com/openclaw/openclaw/security/advisories/GHSA-w2cg-vxx6-5xjg

[Third Party Advisory] https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-large-base-media-file-decoding

Scores

CVSS v3 5.5

EPSS 0.0004

EPSS Percentile 13.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-770

Status draft

Affected Products (2)

npm/openclaw < 2026.2.14npm

npm/clawdbot npm

Timeline

Published Mar 05, 2026

Tracked Since Mar 06, 2026