https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T05:39:34.841108+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-41399 CVE-2026-41399 — OpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket Upgrades 2026-10-03T05:39:34.844182+00:00

Affected: OpenClaw

OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network attackers can exhaust socket and worker capacity to disrupt WebSocket availability for legitimate clients.

 https://vulnerability.circl.lu/vuln/ghsa-f44p-c7w9-7xr7 GHSA-f44p-c7w9-7xr7 — OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades 2026-10-03T05:39:34.844282+00:00

Affected: npm: openclaw

## Summary

The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget.

## Impact

An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients.

## Affected Component

`src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.ts`

## Fixed Versions

- Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `cb5f7e201f` (`gateway: cap concurrent pre-auth websocket upgrades`).

Discovered by：Topsec AlphaLab (wang dong)