CVE-2026-32062 affects OpenClaw versions 2026.2.21-2 prior to 2026.2.22 and @openclaw/voice-call versions 2026.2.21 prior to 2026.2.22. The vulnerability allows unauthenticated clients to establish WebSocket connections for media-stream upgrades before proper stream validation occurs. Remote attackers can exploit this flaw to hold idle pre-authenticated sockets open, consuming connection resources and degrading service availability for legitimate users. This represents a denial of service vulnerability that can impact the availability of voice call services. The issue has been addressed in version 2026.2.22 with proper validation implemented before WebSocket upgrade acceptance.