PT-2026-31775

CVE-2026-35640

Published

2026-03-29

Updated

2026-04-10

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25

Description OpenClaw versions prior to 2026.3.25 are susceptible to a denial of service. The software parses JSON request bodies before validating webhook signatures, which allows unauthenticated attackers to trigger resource-intensive parsing operations. Attackers can send malicious webhook requests to exhaust server resources by forcing JSON parsing before signature rejection.

Recommendations Update to version 2026.3.25 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tdjackey

Vendors

Affected products

Weakness enumeration

CWE-696: Incorrect Behavior Order

CWE-400: Uncontrolled Resource Consumption