VULNERABILITY INTELLIGENCE

CVE-2026-35665

CVSS score6.9 MEDIUM

EPSS probability0.33%

CISA KEVNot currently listed

Published2026-04-10

Last modified2026-06-17

Description

OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated attacker can exhaust server connection resources by sending concurrent slow HTTP POST requests to the Feishu webhook endpoint, blocking legitimate webhook deliveries.