CVE-2026-101881 in Windows
Summary
by MITRE • 09/30/2026
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability represents a critical resource exhaustion flaw within the OpenClaw Windows Node software, specifically affecting versions prior to 2026.7.1. This issue resides in the gateway WebSocket transport layer and is classified as an allocation of resources without limits or control, commonly referenced under CWE-400. The core technical deficiency lies in the application's handling of fragmented WebSocket messages. Specifically, the system fails to enforce boundaries on memory consumption when processing a continuous stream of WebSocket continuation frames that lack the EndOfMessage flag set to true. In standard WebSocket protocol operations, fragmentation allows large messages to be split into multiple smaller frames for transmission efficiency. However, this implementation incorrectly accumulates these incomplete message fragments in memory without applying any size constraints or timeout mechanisms to discard stale or excessively long partial messages.
From an operational perspective, this flaw enables a remote attacker who has established a connection to the gateway WebSocket endpoint to trigger unbounded memory growth on the target node. By sending a persistent sequence of continuation frames that never signal the completion of a message, the attacker forces the server-side process to continuously allocate heap memory for each incoming frame in anticipation of future data belonging to the same logical message stream. Since there is no mechanism to detect or terminate these orphaned streams after a reasonable duration or size threshold, the node's available RAM is progressively consumed until system resources are fully depleted. This state inevitably leads to the termination of the OpenClaw process due to out-of-memory conditions, resulting in a complete denial of service for all users and services relying on that specific node instance.
The impact of this vulnerability extends beyond simple availability loss. In environments where multiple tenants or critical infrastructure components rely on the stability of the gateway nodes, such crashes can cause cascading failures across dependent systems. The lack of input validation regarding message fragmentation limits indicates a fundamental gap in secure coding practices related to resource management during network I/O operations. This aligns with ATT&CK technique T1499, Endpoint Denial of Service, as it involves the deliberate exhaustion of computational resources to disrupt normal system functionality. Furthermore, it reflects CWE-787, Out-of-bounds Write, if the underlying memory allocation logic fails to check bounds before writing fragmented data into buffers, although the primary classification remains resource exhaustion due to uncontrolled accumulation.
Mitigation strategies must focus on implementing strict limits on WebSocket message fragmentation and enforcing timeouts for incomplete messages. Developers should configure maximum allowed sizes for individual frames or total aggregated frame size per connection session. Additionally, introducing a timeout mechanism that automatically discards any partial message stream that has not received its final EndOfMessage flag within a defined time window is essential to prevent indefinite memory retention. Upgrading to OpenClaw version 2026.7.1 or later resolves this issue by applying these necessary controls. Until an upgrade can be performed, network-level mitigations such as rate limiting on WebSocket connections and monitoring for unusually long-lived incomplete sessions may help reduce the risk of exploitation in production environments.