CVE-2026-28461: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28461 is an unbounded memory growth vulnerability in the Zalo webhook endpoint of OpenClaw, a Node.js package, that allows unauthenticated remote attackers to trigger denial-of-service conditions. Affected versions are all OpenClaw releases up to and including 2026.2.26; the issue is patched in version 2026.3.1 and later. The vulnerability was published on March 19, 2026, with the GitHub Security Advisory (GHSA-wr6m-jg37-68xh) credited to reporters Somet2mes and migraine-sudo (GitHub Advisory). It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High), with impact exclusively on availability (GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) — the Zalo webhook endpoint accumulates in-memory keys for each unique query string it receives without bounding or pruning that tracking state. An unauthenticated attacker can exploit this by sending repeated HTTP requests to the reachable webhook route while varying query parameters, causing the in-memory key store to grow without limit. No authentication, special privileges, or user interaction is required, and the attack is fully network-accessible. The fix normalizes tracking keys to matched webhook path semantics (excluding query strings) and enforces bounds/pruning on the tracking state (GitHub Advisory).

Successful exploitation results in unbounded memory accumulation within the OpenClaw process, leading to memory pressure, process instability, and potential out-of-memory (OOM) conditions that degrade or completely deny service availability. There is no confidentiality or integrity impact — the vulnerability is exclusively an availability risk affecting the host running the vulnerable OpenClaw Node.js application (GitHub Advisory). Sustained exploitation could cause the Node.js process to crash, requiring manual restart and resulting in service downtime.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.082%, reflecting a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and is trivially automatable, making it a low-barrier DoS vector against any internet-exposed OpenClaw instance.

1. Reconnaissance: Identify internet-facing services running the OpenClaw Node.js package (versions ≤ 2026.2.26) using tools such as Shodan or Censys, searching for known OpenClaw service banners or the Zalo webhook endpoint path.
2. Locate the Zalo webhook endpoint: Determine the URL path of the Zalo webhook route on the target instance (e.g., /webhook/zalo or similar, as exposed by the application).
3. Craft varied query-string requests: Prepare HTTP GET or POST requests to the webhook endpoint, each with a unique set of query parameters (e.g., ?key1=val1, ?key2=val2, ?key3=val3, etc.) to maximize key churn.
4. Flood with unique query strings: Use a scripted tool (e.g., curl in a loop, Python requests, or ab/wrk) to send a high volume of requests, each with a different query string, to the endpoint without any authentication.
5. Trigger OOM condition: The server's in-memory key store grows unboundedly with each unique query string, eventually exhausting available memory, causing process instability or an OOM crash that denies service to legitimate users (GitHub Advisory).

• Network: High volume of HTTP requests to the Zalo webhook endpoint from one or more source IPs, each request containing unique or randomized query parameters; unusual spike in inbound request rate to the webhook route.
• Logs: Application or web server access logs showing repeated requests to the webhook path with diverse query strings in rapid succession; Node.js process logs showing memory allocation warnings or OOM errors.
• Process: Rapidly increasing memory consumption by the OpenClaw Node.js process (node) observable via system monitoring tools (e.g., top, htop, ps); process crashes or restarts correlated with high-request periods.
• System: OS-level OOM killer events in /var/log/syslog or dmesg referencing the Node.js process; elevated swap usage or system memory exhaustion alerts.

Upgrade OpenClaw to version 2026.3.1 or later, which normalizes webhook tracking keys to path semantics (excluding query strings) and enforces bounds/pruning on tracking state (GitHub Advisory). As an interim measure prior to patching, implement network-level rate limiting on the Zalo webhook endpoint to restrict request frequency and query parameter variation from individual sources. Additionally, restrict access to the webhook endpoint via firewall or reverse proxy ACLs to only trusted Zalo IP ranges where feasible, and monitor system memory utilization for anomalous growth.

The vulnerability received brief coverage from automated security aggregators and social media accounts shortly after disclosure, including posts on Mastodon and Bluesky referencing the CVE. No significant vendor statements beyond the GitHub Security Advisory or notable independent researcher commentary have been identified.