CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



GHSA-MFG5-7Q5G-F37J

GHSA-MFG5-7Q5G-F37J: Denial of Service via Uncontrolled WebSocket Resource Allocation in OpenClaw

Alon Barad
Alon Barad
Software Engineer

Mar 3, 2026·5 min read·31 visits

Executive Summary (TL;DR)

Unauthenticated attackers can exhaust server resources by opening thousands of WebSocket connections to the OpenClaw voice stream endpoint without initiating a session. Patched in version 2026.2.22.

A resource exhaustion vulnerability exists in the `@openclaw/voice-call` package, a core component of the OpenClaw telephony platform. The vulnerability arises from an improper implementation of the WebSocket protocol upgrade mechanism, specifically an "Upgrade-First, Validate-Later" design pattern. By allowing an unlimited number of unauthenticated WebSocket connections to remain in an idle "pre-start" state indefinitely, remote attackers can consume available file descriptors and memory, leading to a Denial of Service (DoS) for legitimate voice services.

Vulnerability Overview

The OpenClaw platform utilizes the @openclaw/voice-call package to handle real-time media streaming via WebSockets. This component is responsible for accepting incoming audio streams for voice calls. In versions prior to 2026.2.22, the MediaStreamHandler class exposed a critical flaw in its connection lifecycle management.

The vulnerability is classified as a Resource Exhaustion Denial of Service (CWE-400). It exploits the disparity between the cost of establishing a WebSocket connection and the server's failure to enforce resource limits on connections that have completed the HTTP upgrade handshake but have not yet authenticated or begun transmitting data. Because the server allocated resources (memory buffers, file descriptors, and event loop cycles) immediately upon connection upgrade—rather than deferring allocation until after validation—the application was susceptible to trivial flooding attacks.

Root Cause Analysis

The root cause is a logic error in the WebSocket handshake process, specifically the lack of an idle timeout for "pre-start" connections. The normal lifecycle of an OpenClaw media stream is:

  1. Client initiates HTTP Upgrade request to /voice/stream.
  2. Server accepts upgrade and establishes WebSocket.
  3. Client sends a JSON start event containing metadata and authentication tokens.
  4. Server validates the start event and begins processing audio.

In the vulnerable implementation, the server enforced no time limit between Step 2 and Step 3. An attacker could complete Step 2 and simply hang the connection. The MediaStreamHandler would maintain the socket in memory indefinitely, waiting for a start event that never arrives. Furthermore, there were no global or per-IP limits on the number of these "pending" connections, allowing a single attacker to saturate the Node.js process's concurrent connection pool.

Code Analysis

The patch introduced in version 2026.2.22 implements a strict state machine with timeouts. Below is a reconstruction of the remediation logic applied to the MediaStreamHandler.

Vulnerable Logic (Conceptual):

// The server upgrades the connection and simply waits for events.
// No timers are set to ensure the client actually sends data.
wss.on('connection', (ws) => {
  ws.on('message', (message) => {
    const event = JSON.parse(message);
    if (event.type === 'start') {
       // Validation happens here, too late in the lifecycle
       validateAndStartStream(ws, event);
    }
  });
});

Patched Logic: The fix introduces a preStartTimeout and a pendingConnections counter. The server now tracks sockets that have upgraded but not yet sent the start frame.

// New configuration parameters
const PRE_START_TIMEOUT = 5000; // 5 seconds
const MAX_PENDING = 32;
 
wss.on('connection', (ws, req) => {
  // 1. Check Global Limits
  if (this.pendingConnections.size >= MAX_PENDING) {
    ws.close(503, 'Server Busy');
    return;
  }
 
  // 2. Track this pending connection
  this.pendingConnections.add(ws);
 
  // 3. Set a "Time to Live" for the pre-start state
  const timeout = setTimeout(() => {
    if (!ws.isStarted) {
      // Force close if 'start' event not received in 5s
      ws.close(1008, 'Start timeout');
      this.pendingConnections.delete(ws);
    }
  }, PRE_START_TIMEOUT);
 
  ws.on('message', (message) => {
    // If valid 'start' received, clear timeout and move to active state
    if (isValidStart(message)) {
      clearTimeout(timeout);
      this.pendingConnections.delete(ws);
      // ... proceed with stream ...
    }
  });
});

This creates a "use it or lose it" policy for network resources. If a client does not authenticate within 5 seconds, the server aggressively reclaims the resources.

Exploitation Methodology

Exploiting this vulnerability requires no authentication and can be performed with standard network tools or simple scripts. The attacker targets the WebSocket endpoint (default /voice/stream).

Attack Steps:

  1. Reconnaissance: Identify the OpenClaw instance and the media stream path.
  2. Connection Flooding: The attacker opens a WebSocket connection but disables the automatic sending of any initial frames.
  3. Resource Holding: The attacker repeats this process, opening thousands of simultaneous connections. Since the server does not close them, the connection count rises monotonically.
  4. Denial of Service: Once the server hits its file descriptor limit (typically 1024 or 4096 on default Linux configurations) or the Node.js heap limit, the application crashes or becomes unresponsive to legitimate traffic.

A Proof-of-Concept (PoC) script would look like this using the ws library:

const WebSocket = require('ws');
const target = 'ws://vulnerable-openclaw.local/voice/stream';
const sockets = [];
 
// Open 5000 idle connections
for (let i = 0; i < 5000; i++) {
  const ws = new WebSocket(target);
  ws.on('open', () => {
    console.log(`Socket ${i} open and holding...`);
    // Intentionally DO NOT send 'start' event
  });
  sockets.push(ws);
}

Impact Assessment

The impact is strictly limited to Availability. There is no risk to Confidentiality or Integrity, as the attacker cannot read existing stream data or inject audio into other calls without valid session tokens.

However, the availability impact is High.

  • Service Outage: Voice services are real-time critical. Even a temporary exhaustion of resources causes dropped calls and prevents new calls from connecting.
  • Infrastructure Instability: If the OpenClaw instance is co-located with other services, the exhaustion of file descriptors (FDs) is an operating-system-level event that can crash adjacent processes or the reverse proxy (e.g., Nginx) fronting the application.
  • Recovery: Recovering from the attack typically requires restarting the service to flush the stuck connections, resulting in downtime.

Official Patches

OpenClawOfficial fix commit implementing timeouts and connection limits

Fix Analysis (1)

Technical Appendix

CVSS Score
6.6/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

@openclaw/voice-callopenclaw

Affected Versions Detail

Product
Affected Versions
Fixed Version
@openclaw/voice-call
OpenClaw
<= 2026.2.212026.2.22
openclaw
OpenClaw
<= 2026.2.212026.2.22
AttributeDetail
CWE IDCWE-400
CVSS6.6 (Medium)
Attack VectorNetwork
AuthenticationNone Required
Exploit MaturityPoC Available
Patch StatusReleased (2026-02-23)

MITRE ATT&CK Mapping

T1499.002Endpoint Denial of Service: Service Exhaustion
Impact
CWE-400
Uncontrolled Resource Consumption

Vulnerability Timeline

Vulnerability reported by researcher jiseoung
2026-02-22
Fix commit merged to main branch
2026-02-22
GHSA-mfg5-7q5g-f37j published
2026-02-22
Patch released in version 2026.2.22
2026-02-23

References & Sources

  • [1]GitHub Advisory: GHSA-mfg5-7q5g-f37j
  • [2]OpenClaw Security Advisory
  • [3]Penligent.ai Technical Writeup

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 4 hours ago•GHSA-7PPR-R889-MCF2
7.5

GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service

An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.

Alon Barad
Alon Barad
5 views•5 min read
•about 5 hours ago•GHSA-95CV-R8X4-VH75
7.6

GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler

A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.

Amit Schendel
Amit Schendel
6 views•7 min read
•about 6 hours ago•GHSA-P6PH-3JX2-3337
4.3

GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList

OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.

Amit Schendel
Amit Schendel
6 views•5 min read
•about 7 hours ago•GHSA-86CX-WWF4-PHQ4
6.5

GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList

An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.

Amit Schendel
Amit Schendel
5 views•6 min read
•about 8 hours ago•CVE-2026-16584
7.0

CVE-2026-16584: Security Policy Bypass in AWS API MCP Server via Startup Initialization Failure

A security policy bypass vulnerability exists in the AWS API MCP Server (awslabs-aws-api-mcp-server) from version 0.2.13 through 1.3.46. When the server fails to load the read-only operations index during startup (due to transient network failures, file permission issues, or other exceptions), it logs a warning but continues running in an insecure, degraded state. Under this condition, the security policy engine fails open, silently skipping all subsequent security checks and consent prompts for the lifetime of the process. This permits unauthorized mutating AWS CLI commands to execute via indirect prompt injection attacks.

Amit Schendel
Amit Schendel
6 views•7 min read
•about 9 hours ago•GHSA-6V4M-FW66-8R4X
6.5

GHSA-6V4M-FW66-8R4X: Path Disclosure and Shell Expansion Bypass in Shescape

An incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.

Alon Barad
Alon Barad
6 views•7 min read