CVE-2026-100558
Received Received - Intake

Resource Exhaustion in OpenClaw Gateway Listener

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth connection budget.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100558
EUVD
EUVD-2026-87492

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a resource exhaustion issue in OpenClaw versions before 2026.8.1. It occurs in the Gateway listener where unauthenticated clients can send malformed WebSocket upgrade requests without completing the connection process. This leaves response sockets open, allowing attackers to repeatedly exploit the flaw and exhaust system resources, causing a denial of service without consuming the WebSocket pre-authentication connection budget.

Detection Guidance

Monitor for unusually high numbers of open sockets or connections on the Gateway listener port. Use netstat or ss commands to check for excessive open connections from the same source IP. Example: netstat -an | grep ESTABLISHED | grep <gateway_port> or ss -s | grep <gateway_port>. Look for patterns of malformed WebSocket upgrade requests in access logs.

Impact Analysis

The impact includes denial of service due to resource exhaustion. Attackers can repeatedly send malformed requests to exhaust listener resources, potentially crashing the system or making services unavailable. Confidentiality and integrity of data are not affected, but availability is compromised depending on listener reachability and host limits.

Compliance Impact

This vulnerability primarily impacts availability by allowing denial of service through resource exhaustion. It does not directly affect confidentiality or integrity of data. Compliance impact depends on the system's role in handling regulated data. For GDPR, availability is a principle but this issue does not involve unauthorized data access. For HIPAA, the lack of data exposure or modification means no direct violation, but service disruption could affect operations handling protected health information.

Mitigation Strategies

Upgrade OpenClaw to version 2026.8.1 or later immediately. If immediate upgrade is not possible, restrict Gateway to loopback or place it behind a proxy that blocks malformed upgrade requests and enforces connection limits. Monitor system resources closely for signs of resource exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100558. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart