VULNERABILITY INTELLIGENCE

CVE-2026-35633

CVSS score5.3 MEDIUM
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-04-09
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate unbounded memory before failure handling occurs.

Weakness classification

  • disclosure@vulncheck.com: CWE-789
  • nvd@nist.gov: CWE-770

Primary references