CVE-2026-28452 MEDIUM

CVE-2026-28452: OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive

Vendor Openclaw
Product OpenClaw
Weakness CWE-770 · Uncontrolled resource consumption
Published March 5, 2026
Last update March 9, 2026
View on NVD All CVEs

CVSS base score

6.7/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.

Key dates

02Disclosure timeline

March 5, 2026 CVE published
March 9, 2026 Record updated