CVE-2026-32049Disclosure(openclaw / openclaw)

LOWCVSS 8.7 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch openclaw openclaw systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage and potential process instability.

openclaw CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/openclaw/openclaw/commit/73d93dee64127a26f1acd09d0403b794cdeb4f5c

Vendor / third-party advisories

Weakness type (CWE)

CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

Patch or workaround signal is available
3 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
3 total mentions across 1 day

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets2 URLs

By indicator

Full discourse3 posts

Agentic Yield@AgenticYield200d
Disclosure
CVE-2026-32049 (HIGH, CVSS 7.5): OpenClaw before 2026.2.22 fails to enforce inbound media byte limits. Remote attacker, no auth required — oversized payload triggers memory spike and process instability. No exploitation known yet, but update now: https://www.redpacketsecurity.com/cve-alert-cve-2026-32049-openclaw-openclaw/
Post summary
The announcement highlights that OpenClaw before version 2026.2.22 is susceptible to memory exhaustion via oversized payloads with no authentication, but no exploitation has been observed yet.
0000046
11 followersView on X
RedPacket Security@RedPacketSec201d
Disclosure
CVE Alert: CVE-2026-32049 - OpenClaw - OpenClaw - https://www.redpacketsecurity.com/cve-alert-cve-2026-32049-openclaw-openclaw/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-32049 #openclaw #
Post summary
Red Packet Security issued a CVE alert for CVE‑2026‑32049 affecting OpenClaw, announcing the vulnerability for the first time.
0000083
3.6K followersView on X
CVE@CVEnew201d
Patch
CVE-2026-32049 OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion… https://www.cve.org/CVERecord?id=CVE-2026-32049
Post summary
The post highlights a CVE affecting OpenClaw, noting that versions before 2026.2.22 are vulnerable and that a patch is available in newer releases, without mention of PoC, exploits, or active attacks.
0000066
56.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities