CVE-2026-42437
Denial of Service in OpenClaw via WebSocket Frame Overflow
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | From 2026.4.10 (inc) |
| openclaw | openclaw | 2026.4.14 |
| openclaw | openclaw | to 2026.4.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-42437 is a denial of service vulnerability in OpenClaw versions before 2026.4.10. It affects the voice-call realtime WebSocket path, which accepts oversized frames without proper validation.
Remote attackers can exploit this by sending oversized WebSocket frames to the webhook path, causing the service to become unavailable.
The root cause is the lack of limits or throttling on resource allocation when processing these frames, leading to uncontrolled resource consumption.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-42437 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
This vulnerability can cause a denial of service (DoS) condition by making the OpenClaw service unavailable.
If your deployment exposes the voice-call realtime WebSocket webhook path, attackers can send oversized frames that overwhelm the system, leading to service crashes or unavailability.
This can disrupt voice-call functionality and impact the reliability of your service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the voice-call realtime WebSocket path accepting oversized frames without proper validation, which can cause denial of service.
To detect exploitation attempts on your network or system, you should monitor WebSocket traffic to the voice-call realtime webhook path for unusually large frames exceeding the expected size limit (256 KB as per the fix).
Commands or methods to detect this might include using network traffic analysis tools such as tcpdump or Wireshark to filter WebSocket frames and check their payload sizes.
- Use tcpdump to capture WebSocket traffic on the relevant port, for example: tcpdump -i <interface> port <websocket_port> -w capture.pcap
- Analyze the capture with Wireshark, filtering for WebSocket frames and inspecting frame sizes to identify oversized frames.
- Alternatively, use WebSocket-specific monitoring tools or scripts to log and alert on frames exceeding 256 KB.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to upgrade OpenClaw to version 2026.4.10 or later, as this version includes a fix that rejects oversized realtime WebSocket frames.
The fix enforces a maximum payload size of 256 KB for WebSocket messages and adds error handling to close connections gracefully when oversized frames are received.
If upgrading immediately is not possible, consider implementing network-level controls to limit the size of WebSocket frames or restrict access to the voice-call realtime webhook path to trusted sources only.