CVE-2026-29612
OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks
Impact
## Summary Base64-backed media inputs could be decoded into Buffers before enforcing decoded-size budgets. An attacker supplying oversized base64 payloads can force large allocations, causing memory pressure and denial of service. ## Attack Scenario Notes - Recommended deployments bind the gateway to loopback by default and require gateway auth for HTTP endpoints. In that configuration, this is best modeled as a local/authorized DoS. - If an operator exposes the gateway to untrusted networks (or disables/weakens auth and rate limits), treat this as a higher-severity network DoS risk. ## Affected Packages / Versions - openclaw (npm): <= 2026.2.13 - clawdbot (npm): <= 2026.1.24-3 ## Fixed In - openclaw (npm): 2026.2.14 (planned) - clawdbot (npm): no patched release planned; migrate to openclaw ## Fix Commit(s) - 31791233d60495725fa012745dde8d6ee69e9595 ## Credits Thanks @vincentkoc for reporting.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | openclaw | < 2026.2.14 | 2026.2.14 |
| npm | clawdbot | <= 2026.1.24-3 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openclaw | Openclaw | before 2026.2.14 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/openclaw/openclaw/commit/31791233d60495725fa012745dde8d6ee69e9595
- https://github.com/openclaw/openclaw/security/advisories/GHSA-w2cg-vxx6-5xjg
- https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-large-base-media-file-decoding
- https://github.com/advisories/GHSA-w2cg-vxx6-5xjg
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.14
- https://nvd.nist.gov/vuln/detail/CVE-2026-29612