CVE-2026-35665 - Vulnerability Analysis

Overview

OpenClaw before 2026.3.24 contains a denial of service caused by permissive request body size and timeout limits in the Feishu webhook handler before signature verification, letting unauthenticated attackers exhaust server connection resources via slow HTTP POST requests.

Severity & Score

Impact

Unauthenticated attackers can exhaust server resources, causing denial of service and blocking legitimate webhook deliveries.

Mitigation

Update to version 2026.3.24 or later.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-w6m8-cqvj-pg5v
• https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-feishu-webhook-pre-auth-body-parsing

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner