提出 #875791: OpenClaw openclaw <= 2026.3.14 Uncontrolled Resource Consumption (CWE-400)

# Technical Details
An unbounded memory allocation vulnerability exists in the `readErrorBodySnippet` function in `src/media/fetch.ts` of OpenClaw.

The application introduced bounded response reading for successful remote media downloads, but the HTTP error-response path still reads the full body with `res.text()` before truncating it for an error message. A malicious public HTTP server can return a non-2xx status code with an arbitrarily large body, causing OpenClaw to allocate the complete response in memory and crash.

# Vulnerable Code
File: src/media/fetch.ts
Method: readErrorBodySnippet
Why: The function calls `res.text()` on error responses and only truncates after the entire body has already been buffered. The success path uses `readResponseWithLimit`, but the error path called from `fetchRemoteMedia` does not enforce `maxBytes`.

# Reproduction
1. Configure OpenClaw with remote media fetching enabled.
2. Host a public HTTP endpoint that returns an error status such as HTTP 400 with a very large response body.
3. Send a chat message containing a media URL pointing to that endpoint.
4. Observe that `fetchRemoteMedia` enters the error path, calls `readErrorBodySnippet`, buffers the full response body, and can exhaust process memory.

# Impact
- Remote unauthenticated denial of service through a crafted media URL.
- Memory exhaustion and OpenClaw process crash.
- The SSRF guard does not block the attack when the malicious server is on the public internet.

Reference Link: https://gist.github.com/YLChen-007/142041a85dc9a7dd079b0ebe358ac0af

• ソース: ⚠️ https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw
• ユーザー: AbamaYouLong (UID 99186)
• 送信: 2026年07月01日 08:28 (3 月 ago)
• モデレーション: 2026年08月17日 11:45 (2 months later)
• ステータス: 重複
• VulDBエントリ: 356766 [OpenClaw 迄 2026.3.21 サービス拒否]
• ポイント: 0