CVE-2026-35633

MediumCVSS 5.3/10Last modified Nov 11, 2026

Description

OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate unbounded memory before failure handling occurs.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-789CWE-770

Affected software

VendorProductVersions
OpenClawOpenClaw< 2026.3.22

References

Timeline

Published
Apr 9, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-356345.1OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionalCVE-2026-356356.5OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to coCVE-2026-356366.5OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to caCVE-2026-356377.3OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handCVE-2026-356388.8OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain selCVE-2026-356398.8OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing apCVE-2026-35649.0A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authenticatCVE-2026-356407.5OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resouCVE-2026-356417.8OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to CVE-2026-356424.3OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access controCVE-2026-356438.8OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructiCVE-2026-356446.5OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credenti
CVE-2026-35633: Medium severity, CVSS 5.3 | Vulnix