CVE-2026-28394 MEDIUM

CVE-2026-28394: OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool

Vendor Openclaw
Product OpenClaw
Weakness CWE-770 · Uncontrolled resource consumption
Published March 5, 2026
Last update March 11, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML responses. Remote attackers can social-engineer users into fetching malicious URLs with pathological HTML structures to exhaust server memory and cause service unavailability.

Key dates

02Disclosure timeline

March 5, 2026 CVE published
March 11, 2026 Record updated