提交 #875791: OpenClaw openclaw <= 2026.3.14 Uncontrolled Resource Consumption (CWE-400)

# Technical Details
An unbounded memory allocation vulnerability exists in the `readErrorBodySnippet` function in `src/media/fetch.ts` of OpenClaw.

The application introduced bounded response reading for successful remote media downloads, but the HTTP error-response path still reads the full body with `res.text()` before truncating it for an error message. A malicious public HTTP server can return a non-2xx status code with an arbitrarily large body, causing OpenClaw to allocate the complete response in memory and crash.

# Vulnerable Code
File: src/media/fetch.ts
Method: readErrorBodySnippet
Why: The function calls `res.text()` on error responses and only truncates after the entire body has already been buffered. The success path uses `readResponseWithLimit`, but the error path called from `fetchRemoteMedia` does not enforce `maxBytes`.

# Reproduction
1. Configure OpenClaw with remote media fetching enabled.
2. Host a public HTTP endpoint that returns an error status such as HTTP 400 with a very large response body.
3. Send a chat message containing a media URL pointing to that endpoint.
4. Observe that `fetchRemoteMedia` enters the error path, calls `readErrorBodySnippet`, buffers the full response body, and can exhaust process memory.

# Impact
- Remote unauthenticated denial of service through a crafted media URL.
- Memory exhaustion and OpenClaw process crash.
- The SSRF guard does not block the attack when the malicious server is on the public internet.

Reference Link: https://gist.github.com/YLChen-007/142041a85dc9a7dd079b0ebe358ac0af

• 来源: ⚠️ https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw
• 用户: AbamaYouLong (UID 99186)
• 提交: 2026-07-01 08時28分 (3 月前)
• 管理: 2026-08-17 11時45分 (2 months later)
• 状态: 重复
• VulDB条目: 356766 [OpenClaw 直到 2026.3.21 拒绝服务]
• 积分: 0