| tiêu đề | OpenClaw [email protected] Denial of Service |
|---|
| Mô tả | OpenClaw 2026.6.11 contains a denial of service vulnerability in the Canvas Host file GET interface. The affected route is GET /__openclaw__/canvas/<file>. The Canvas Host implementation reads the entire requested file into memory using handle.readFile() and sends it with res.end(data), without enforcing a file size limit, streaming response, request concurrency limit, or slow-client protection.
An attacker with access to the Canvas Host route can open multiple slow-read GET connections to a large Canvas-hosted file. Each request can cause the server to allocate a large response buffer, while the slow client keeps the response from being released quickly. This can rapidly consume memory and event-loop capacity in the OpenClaw Node.js process.
Successful exploitation can cause service-wide denial of service, including severe latency, health check failures, request timeouts, and unavailability of normal OpenClaw endpoints for other users on the same instance. In local reproduction, 32 slow-read GET connections to a 768 MiB Canvas file caused repeated health endpoint timeouts and returned RESULT=UNAVAILABLE. |
|---|
| Nguồn | ⚠️ https://github.com/lche511/cve/tree/main/OpenClaw_Canvas_Big_GET_DoS_Report |
|---|
| Người dùng | pengguogood (UID 72903) |
|---|
| Đệ trình | 07/07/2026 09:15 (cách đây 3 các tháng) |
|---|
| Kiểm duyệt | 20/09/2026 11:07 (3 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 408023 [OpenClaw đến 2026.9.5 Canvas Host Route server.ts createCanvasHostHandler Từ chối dịch vụ] |
|---|
| điểm | 20 |
|---|