https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T17:13:17.990408+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-32049 CVE-2026-32049 — OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass 2026-10-02T17:13:17.992855+00:00

Affected: OpenClaw

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage and potential process instability.

 https://vulnerability.circl.lu/vuln/ghsa-rxxp-482v-7mrh GHSA-rxxp-482v-7mrh — OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels 2026-10-02T17:13:17.992966+00:00

Affected: npm: openclaw

## Summary OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection.

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.21-2` (latest published at triage time) - Fixed in: `2026.2.22` (planned next release)

## Impact An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads.

## Fix Commit(s) - `73d93dee64127a26f1acd09d0403b794cdeb4f5c`

## Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.22`). After that npm release is published, this advisory can be published without further version-field edits.

OpenClaw thanks @tdjackey for reporting.