CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



GHSA-MFG5-7Q5G-F37J

GHSA-MFG5-7Q5G-F37J: Denial of Service via Uncontrolled WebSocket Resource Allocation in OpenClaw

Alon Barad
Alon Barad
Software Engineer

Mar 3, 2026·5 min read·28 visits

Executive Summary (TL;DR)

Unauthenticated attackers can exhaust server resources by opening thousands of WebSocket connections to the OpenClaw voice stream endpoint without initiating a session. Patched in version 2026.2.22.

A resource exhaustion vulnerability exists in the `@openclaw/voice-call` package, a core component of the OpenClaw telephony platform. The vulnerability arises from an improper implementation of the WebSocket protocol upgrade mechanism, specifically an "Upgrade-First, Validate-Later" design pattern. By allowing an unlimited number of unauthenticated WebSocket connections to remain in an idle "pre-start" state indefinitely, remote attackers can consume available file descriptors and memory, leading to a Denial of Service (DoS) for legitimate voice services.

Vulnerability Overview

The OpenClaw platform utilizes the @openclaw/voice-call package to handle real-time media streaming via WebSockets. This component is responsible for accepting incoming audio streams for voice calls. In versions prior to 2026.2.22, the MediaStreamHandler class exposed a critical flaw in its connection lifecycle management.

The vulnerability is classified as a Resource Exhaustion Denial of Service (CWE-400). It exploits the disparity between the cost of establishing a WebSocket connection and the server's failure to enforce resource limits on connections that have completed the HTTP upgrade handshake but have not yet authenticated or begun transmitting data. Because the server allocated resources (memory buffers, file descriptors, and event loop cycles) immediately upon connection upgrade—rather than deferring allocation until after validation—the application was susceptible to trivial flooding attacks.

Root Cause Analysis

The root cause is a logic error in the WebSocket handshake process, specifically the lack of an idle timeout for "pre-start" connections. The normal lifecycle of an OpenClaw media stream is:

  1. Client initiates HTTP Upgrade request to /voice/stream.
  2. Server accepts upgrade and establishes WebSocket.
  3. Client sends a JSON start event containing metadata and authentication tokens.
  4. Server validates the start event and begins processing audio.

In the vulnerable implementation, the server enforced no time limit between Step 2 and Step 3. An attacker could complete Step 2 and simply hang the connection. The MediaStreamHandler would maintain the socket in memory indefinitely, waiting for a start event that never arrives. Furthermore, there were no global or per-IP limits on the number of these "pending" connections, allowing a single attacker to saturate the Node.js process's concurrent connection pool.

Code Analysis

The patch introduced in version 2026.2.22 implements a strict state machine with timeouts. Below is a reconstruction of the remediation logic applied to the MediaStreamHandler.

Vulnerable Logic (Conceptual):

// The server upgrades the connection and simply waits for events.
// No timers are set to ensure the client actually sends data.
wss.on('connection', (ws) => {
  ws.on('message', (message) => {
    const event = JSON.parse(message);
    if (event.type === 'start') {
       // Validation happens here, too late in the lifecycle
       validateAndStartStream(ws, event);
    }
  });
});

Patched Logic: The fix introduces a preStartTimeout and a pendingConnections counter. The server now tracks sockets that have upgraded but not yet sent the start frame.

// New configuration parameters
const PRE_START_TIMEOUT = 5000; // 5 seconds
const MAX_PENDING = 32;
 
wss.on('connection', (ws, req) => {
  // 1. Check Global Limits
  if (this.pendingConnections.size >= MAX_PENDING) {
    ws.close(503, 'Server Busy');
    return;
  }
 
  // 2. Track this pending connection
  this.pendingConnections.add(ws);
 
  // 3. Set a "Time to Live" for the pre-start state
  const timeout = setTimeout(() => {
    if (!ws.isStarted) {
      // Force close if 'start' event not received in 5s
      ws.close(1008, 'Start timeout');
      this.pendingConnections.delete(ws);
    }
  }, PRE_START_TIMEOUT);
 
  ws.on('message', (message) => {
    // If valid 'start' received, clear timeout and move to active state
    if (isValidStart(message)) {
      clearTimeout(timeout);
      this.pendingConnections.delete(ws);
      // ... proceed with stream ...
    }
  });
});

This creates a "use it or lose it" policy for network resources. If a client does not authenticate within 5 seconds, the server aggressively reclaims the resources.

Exploitation Methodology

Exploiting this vulnerability requires no authentication and can be performed with standard network tools or simple scripts. The attacker targets the WebSocket endpoint (default /voice/stream).

Attack Steps:

  1. Reconnaissance: Identify the OpenClaw instance and the media stream path.
  2. Connection Flooding: The attacker opens a WebSocket connection but disables the automatic sending of any initial frames.
  3. Resource Holding: The attacker repeats this process, opening thousands of simultaneous connections. Since the server does not close them, the connection count rises monotonically.
  4. Denial of Service: Once the server hits its file descriptor limit (typically 1024 or 4096 on default Linux configurations) or the Node.js heap limit, the application crashes or becomes unresponsive to legitimate traffic.

A Proof-of-Concept (PoC) script would look like this using the ws library:

const WebSocket = require('ws');
const target = 'ws://vulnerable-openclaw.local/voice/stream';
const sockets = [];
 
// Open 5000 idle connections
for (let i = 0; i < 5000; i++) {
  const ws = new WebSocket(target);
  ws.on('open', () => {
    console.log(`Socket ${i} open and holding...`);
    // Intentionally DO NOT send 'start' event
  });
  sockets.push(ws);
}

Impact Assessment

The impact is strictly limited to Availability. There is no risk to Confidentiality or Integrity, as the attacker cannot read existing stream data or inject audio into other calls without valid session tokens.

However, the availability impact is High.

  • Service Outage: Voice services are real-time critical. Even a temporary exhaustion of resources causes dropped calls and prevents new calls from connecting.
  • Infrastructure Instability: If the OpenClaw instance is co-located with other services, the exhaustion of file descriptors (FDs) is an operating-system-level event that can crash adjacent processes or the reverse proxy (e.g., Nginx) fronting the application.
  • Recovery: Recovering from the attack typically requires restarting the service to flush the stuck connections, resulting in downtime.

Official Patches

OpenClawOfficial fix commit implementing timeouts and connection limits

Fix Analysis (1)

Technical Appendix

CVSS Score
6.6/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

@openclaw/voice-callopenclaw

Affected Versions Detail

Product
Affected Versions
Fixed Version
@openclaw/voice-call
OpenClaw
<= 2026.2.212026.2.22
openclaw
OpenClaw
<= 2026.2.212026.2.22
AttributeDetail
CWE IDCWE-400
CVSS6.6 (Medium)
Attack VectorNetwork
AuthenticationNone Required
Exploit MaturityPoC Available
Patch StatusReleased (2026-02-23)

MITRE ATT&CK Mapping

T1499.002Endpoint Denial of Service: Service Exhaustion
Impact
CWE-400
Uncontrolled Resource Consumption

Vulnerability Timeline

Vulnerability reported by researcher jiseoung
2026-02-22
Fix commit merged to main branch
2026-02-22
GHSA-mfg5-7q5g-f37j published
2026-02-22
Patch released in version 2026.2.22
2026-02-23

References & Sources

  • [1]GitHub Advisory: GHSA-mfg5-7q5g-f37j
  • [2]OpenClaw Security Advisory
  • [3]Penligent.ai Technical Writeup

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 5 hours ago•CVE-2026-53634
4.3

CVE-2026-53634: Missing Authorization in Code16 Sharp Quick Creation Command Controller

Code16 Sharp versions from 9.0.0 up to (but not including) 9.22.3 are vulnerable to a missing authorization flaw in the Quick Creation Command feature. The ApiEntityListQuickCreationCommandController fails to validate entity-level 'create' policies before returning administrative form designs or processing database modifications. Authenticated users with restricted access can bypass policy boundaries to access creation configurations and insert records.

Alon Barad
Alon Barad
5 views•5 min read
•about 6 hours ago•CVE-2026-49471
8.3

CVE-2026-49471: Unauthenticated Remote Code Execution in Serena MCP Toolkit via DNS Rebinding and Memory Poisoning

CVE-2026-49471 is a high-severity security vulnerability in Serena, an AI-assisted coding Model Context Protocol (MCP) toolkit. In versions prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a predictable port. Lacking host validation and CSRF protections, this endpoint is vulnerable to DNS Rebinding. An attacker can lure a user to a malicious webpage, bypass the Same-Origin Policy (SOP), rewrite the AI agent's persistent memory, and execute arbitrary commands on the host operating system via the autonomous agent's shell execution engine.

Alon Barad
Alon Barad
8 views•5 min read
•about 6 hours ago•GHSA-MXWC-WH95-PW4G
5.3

GHSA-MXWC-WH95-PW4G: Denial of Service via Uncontrolled Recursion in Trapster DNS Parser

The trapster honeypot package is vulnerable to a remote denial of service (DoS) vulnerability due to uncontrolled recursion during the parsing of malformed DNS compression pointers in the decode_labels function.

Amit Schendel
Amit Schendel
6 views•6 min read
•about 7 hours ago•GHSA-Q95X-7G78-RCCV
6.3

GHSA-Q95X-7G78-RCCV: Safe Rust Memory Corruption via Use-After-Free in oneringbuf Crate

A critical Use-After-Free (UAF) memory corruption vulnerability exists in the oneringbuf Rust crate prior to version 0.8.0. The vulnerability allows safe Rust code to instantiate and clone reference wrappers that point to heap-allocated ring buffers. Dropping one wrapper prematurely reclaims the backing memory, leading to dangling pointer references and subsequent Use-After-Free or Double Free states.

Amit Schendel
Amit Schendel
6 views•7 min read
•about 19 hours ago•CVE-2026-53359
8.8

CVE-2026-53359: Use-After-Free in Linux Kernel KVM Shadow MMU (Januscape)

Januscape (CVE-2026-53359) is a critical Use-After-Free vulnerability in the x86 Shadow MMU component of the Linux Kernel's KVM subsystem. A logic error in shadow page tracking permits unauthorized page reuse without validating architectural execution roles, leading to dangling pointers in reverse mapping (rmap) tracking entries during guest memory teardown.

Amit Schendel
Amit Schendel
83 views•5 min read
•about 20 hours ago•CVE-2026-48282
10.0

CVE-2026-48282: Unauthenticated Path Traversal and Arbitrary File Write in Adobe ColdFusion Remote Development Services

CVE-2026-48282 is a critical unauthenticated path traversal and arbitrary file write vulnerability in the Remote Development Services (RDS) component of Adobe ColdFusion. The vulnerability allows a remote, unauthenticated attacker to bypass directory boundaries and write arbitrary files, including CFML-based web shells, onto the host server. This flaw is actively exploited in the wild and enables full unauthenticated remote code execution under the privileges of the ColdFusion service account.

Alon Barad
Alon Barad
39 views•6 min read