CVE-2026-42437

HIGH

OpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path

Title source: cna
STIX 2.1

Description

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the webhook path.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-vw3h-q6xq-jjm5)
https://github.com/openclaw/openclaw/security/advisories/GHSA-vw3h-q6xq-jjm5
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path
https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-oversized-websocket-frames-in-voice-call-realtime-path

Scores

CVSS v3 7.5
EPSS 0.0009
EPSS Percentile 25.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-770
Status published
Products (3)
npm/openclaw 2026.4.9 - 2026.4.10npm
OpenClaw/OpenClaw 2026.4.10
OpenClaw/OpenClaw 2026.4.9 - 2026.4.10
Published May 05, 2026
Tracked Since May 05, 2026