CVE-2026-32062: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32062 is a WebSocket resource exhaustion vulnerability in OpenClaw and its @openclaw/voice-call package that allows unauthenticated remote attackers to degrade service availability by holding idle pre-authenticated sockets open. Affected versions are OpenClaw 2026.2.21-2 up to (but not including) 2026.2.22, and @openclaw/voice-call 2026.2.21 up to (but not including) 2026.2.22. The vulnerability was published on March 11, 2026, with a patch released as version 2026.2.22 for both packages. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-400 (Uncontrolled Resource Consumption). Before the fix, the voice-call media-stream path performed the WebSocket upgrade handshake first and only ran shouldAcceptStream() validation after receiving a subsequent start frame — creating a pre-authentication window during which remote clients could hold idle sockets open indefinitely without providing any call or token credentials. No privileges, user interaction, or special network position are required; any network-reachable attacker can initiate WebSocket upgrade requests to the media-stream endpoint and simply never send a valid start frame, causing sockets to accumulate (GitHub Advisory, Patch Commit).

Successful exploitation results in a denial-of-service condition affecting the availability of the media-stream endpoint. By exhausting connection-related resources (file descriptors, memory, thread pool slots), an attacker can degrade or completely block service for legitimate voice-call streams. There is no confidentiality or integrity impact — the vulnerability is purely an availability risk in deployments where the media-stream endpoint is network-reachable and streaming is enabled (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.091%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploitation evidence, the attack requires no authentication, no user interaction, and low complexity, making it straightforward to abuse if the endpoint is internet-exposed (Feedly, GitHub Advisory).

1. Reconnaissance: Identify internet-facing OpenClaw deployments with the media-stream WebSocket endpoint exposed (default path: /voice/stream), using tools like Shodan or Censys to search for the service.
2. Initiate WebSocket upgrade: Send an HTTP Upgrade request to the target's media-stream endpoint (e.g., ws://<target>/voice/stream) to establish a WebSocket connection — the server accepts the upgrade without any authentication check.
3. Hold the socket idle: After the upgrade is accepted, do not send any start frame or valid payload. The pre-patched server has no timeout or connection cap, so the socket remains open indefinitely in a pre-authenticated state.
4. Scale the attack: Repeat steps 2–3 in parallel from one or more source IPs to open many idle sockets simultaneously, consuming the server's connection resources (file descriptors, memory).
5. Achieve denial of service: As resources are exhausted, legitimate voice-call streams are unable to establish connections, degrading or completely blocking the media-stream service (GitHub Advisory, Patch Commit).

• Network: High volume of WebSocket upgrade requests (HTTP 101 Switching Protocols) to the media-stream endpoint (default: /voice/stream) from one or more source IPs; large number of long-lived WebSocket connections that never send a start frame.
• Logs: Server access logs showing many concurrent WebSocket connections to /voice/stream with no subsequent application-level messages; connection counts far exceeding normal operational baselines.
• Process/Resource: Elevated file descriptor usage or memory consumption by the Node.js OpenClaw process; OS-level alerts on socket exhaustion or connection table saturation.
• Application: Legitimate voice-call streams failing to connect or timing out; error logs indicating inability to accept new WebSocket connections (GitHub Advisory).

Upgrade OpenClaw to version 2026.2.22 or later and @openclaw/voice-call to version 2026.2.22 or later — this is the primary remediation. The patch (commit 1d8968c) adds layered controls: a strict pre-start timeout (preStartTimeoutMs, default 5000 ms) that closes sockets not sending a valid start frame, a global pending-connection cap (maxPendingConnections, default 32), a per-IP pending-connection cap (maxPendingConnectionsPerIp, default 4), and a total open media-stream connection cap (maxConnections, default 128). As a network-level workaround prior to patching, implement rate limiting and connection throttling on the WebSocket endpoint at the load balancer or firewall, and restrict access to the media-stream endpoint to trusted IP ranges where possible (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher @jiseoung and the advisory was published by steipete on the OpenClaw GitHub repository. Social media activity was limited to automated CVE-tracking accounts on Bluesky and Mastodon, and aggregator posts from RedPacketSecurity. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database syndication (GitHub Advisory).