CVE-2026-35633: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35633 is an unbounded memory allocation vulnerability in OpenClaw's remote media HTTP error handling that allows unauthenticated remote attackers to trigger excessive memory consumption, potentially causing a denial of service. It affects all OpenClaw (npm) versions before 2026.3.22. The vulnerability was disclosed on April 9, 2026, with the fix shipping in version 2026.3.22. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Feedly).

The root cause is that OpenClaw's readErrorBodySnippet function in src/media/fetch.ts called res.text() to read HTTP error response bodies without any size cap, allowing the full body to be buffered into memory regardless of size (CWE-789: Memory Allocation with Excessive Size Value; CWE-770: Allocation of Resources Without Limits or Throttling). An attacker positioned to serve crafted HTTP error responses — for example, by controlling a remote media endpoint that OpenClaw fetches from — can return a non-2xx response with an arbitrarily large body, causing the application to allocate unbounded memory before failure handling occurs. No authentication or user interaction is required. The fix refactored error-body reading through a new readResponseTextSnippet function in src/media/read-response-with-limit.ts that enforces an 8 KB byte cap and idle chunk timeouts, truncating oversized snippets before surfacing failure text (Github Advisory, Fix Commit).

Successful exploitation results in excessive memory consumption on the OpenClaw server, which can degrade performance or crash the application, causing a denial of service. There is no impact on confidentiality or integrity — the vulnerability is limited to availability of the affected OpenClaw instance. Lateral movement and data exfiltration are not directly enabled by this vulnerability (Github Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.0024 (0.24%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Identify target: Locate an OpenClaw instance (npm package) running a version earlier than 2026.3.22 that fetches remote media from attacker-controllable or attacker-influenced URLs.
2. Control or spoof a remote media endpoint: Set up an HTTP server that returns a non-2xx response (e.g., HTTP 400 or 500) with an extremely large response body (e.g., hundreds of megabytes or more) when queried.
3. Trigger remote media fetch: Cause the vulnerable OpenClaw instance to fetch media from the attacker-controlled endpoint — for example, by submitting a message or request that includes a URL pointing to the malicious server.
4. Exploit unbounded buffering: The vulnerable readErrorBodySnippet function calls res.text() on the error response without a size limit, causing OpenClaw to buffer the entire large response body into memory.
5. Achieve denial of service: Memory exhaustion causes the OpenClaw process to slow significantly or crash, resulting in service unavailability (Github Advisory, Fix Commit).

• Process: Sudden spike in memory usage of the OpenClaw Node.js process, potentially leading to OOM (out-of-memory) kills or process crashes.
• Logs: Application logs showing repeated HTTP error responses (4xx/5xx) from remote media endpoints, particularly with unusually large response sizes or slow reads; Node.js heap allocation errors or crash dumps.
• Network: Outbound HTTP requests from the OpenClaw server to external endpoints that return large non-2xx responses; sustained or repeated connections to the same remote media URL returning error status codes with large bodies.

Upgrade OpenClaw (npm) to version 2026.3.22 or later, which routes non-2xx error body reads through the new bounded readResponseTextSnippet function with an 8 KB cap and idle timeouts. For environments where immediate patching is not feasible, implement network-level controls to restrict which remote media endpoints OpenClaw can reach, limiting exposure to attacker-controlled servers. Monitoring for unusual HTTP error response patterns with large body sizes from remote media endpoints can help detect exploitation attempts (Github Advisory, Fix Commit).