Submit #875791: OpenClaw openclaw <= 2026.3.14 Uncontrolled Resource Consumption (CWE-400)

# Technical Details
An unbounded memory allocation vulnerability exists in the `readErrorBodySnippet` function in `src/media/fetch.ts` of OpenClaw.

The application introduced bounded response reading for successful remote media downloads, but the HTTP error-response path still reads the full body with `res.text()` before truncating it for an error message. A malicious public HTTP server can return a non-2xx status code with an arbitrarily large body, causing OpenClaw to allocate the complete response in memory and crash.

# Vulnerable Code
File: src/media/fetch.ts
Method: readErrorBodySnippet
Why: The function calls `res.text()` on error responses and only truncates after the entire body has already been buffered. The success path uses `readResponseWithLimit`, but the error path called from `fetchRemoteMedia` does not enforce `maxBytes`.

# Reproduction
1. Configure OpenClaw with remote media fetching enabled.
2. Host a public HTTP endpoint that returns an error status such as HTTP 400 with a very large response body.
3. Send a chat message containing a media URL pointing to that endpoint.
4. Observe that `fetchRemoteMedia` enters the error path, calls `readErrorBodySnippet`, buffers the full response body, and can exhaust process memory.

# Impact
- Remote unauthenticated denial of service through a crafted media URL.
- Memory exhaustion and OpenClaw process crash.
- The SSRF guard does not block the attack when the malicious server is on the public internet.

Reference Link: https://gist.github.com/YLChen-007/142041a85dc9a7dd079b0ebe358ac0af

• Source: ⚠️ https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw
• User: AbamaYouLong (UID 99186)
• Submission: 07/01/2026 08:28 (2 months ago)
• Moderation: 08/17/2026 11:45 (2 months later)
• Status: Duplicate
• VulDB entry: 356766 [OpenClaw up to 2026.3.21 memory allocation]
• Points: 0