OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion...
Date: 2026-03
Affected: openclaw/openclaw
Attack vector: dos
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-27001
CVE-2026-27002
CVE-2026-27007
CVE-2026-27008
CVE-2026-27009
CVE-2026-28394
CVE-2026-28479
CWE: CWE-1254
CWE-250
CWE-327
CWE-73
CWE-77
CWE-770
CWE-79
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML responses. Remote attackers can social-engineer users into fetching malicious URLs with pathological HTML structures to exhaust server memory and cause service unavailability.


Mitigations:

Architectural layers (MAESTRO):