| 제목 | OpenClaw openclaw <= 2026.3.14 Uncontrolled Resource Consumption (CWE-400) |
|---|
| 설명 | # Technical Details
An unbounded memory allocation vulnerability exists in the `readErrorBodySnippet` function in `src/media/fetch.ts` of OpenClaw.
The application introduced bounded response reading for successful remote media downloads, but the HTTP error-response path still reads the full body with `res.text()` before truncating it for an error message. A malicious public HTTP server can return a non-2xx status code with an arbitrarily large body, causing OpenClaw to allocate the complete response in memory and crash.
# Vulnerable Code
File: src/media/fetch.ts
Method: readErrorBodySnippet
Why: The function calls `res.text()` on error responses and only truncates after the entire body has already been buffered. The success path uses `readResponseWithLimit`, but the error path called from `fetchRemoteMedia` does not enforce `maxBytes`.
# Reproduction
1. Configure OpenClaw with remote media fetching enabled.
2. Host a public HTTP endpoint that returns an error status such as HTTP 400 with a very large response body.
3. Send a chat message containing a media URL pointing to that endpoint.
4. Observe that `fetchRemoteMedia` enters the error path, calls `readErrorBodySnippet`, buffers the full response body, and can exhaust process memory.
# Impact
- Remote unauthenticated denial of service through a crafted media URL.
- Memory exhaustion and OpenClaw process crash.
- The SSRF guard does not block the attack when the malicious server is on the public internet.
Reference Link: https://gist.github.com/YLChen-007/142041a85dc9a7dd079b0ebe358ac0af |
|---|
| 원천 | ⚠️ https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw |
|---|
| 사용자 | AbamaYouLong (UID 99186) |
|---|
| 제출 | 2026. 07. 01. AM 08:28 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 17. AM 11:45 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 356766 [OpenClaw 까지 2026.3.21 서비스 거부] |
|---|
| 포인트들 | 0 |
|---|