CVSS 5.3 · MEDIUM
CVE-2026-41400
OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. Remote attackers can send oversized pre-start WebSocket frames to cause resource consumption and denial of service.
View on NVDSeverity
Score: 5.3(MEDIUM)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LAV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: NONE
I: NONE
A: LOW
Weakness (CWE):
CWE-770EPSS
Probability of exploitation (next 30 days): 0.0015 (0.2%)
Percentile: 35.2%
EPSS: 2026-05-06
Affects
openclaw:openclawTechnical description
OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. Remote attackers can send oversized pre-start WebSocket frames to cause resource consumption and denial of service.
Published: 4/28/2026, 7:37:43 PM
Last modified: 4/30/2026, 5:27:07 PM