OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through …

Published:

4 maart 2026 om 23:00:00

Alert date:

5 maart 2026 om 23:13:13

Source:

nvd.nist.gov

Web Technologies

OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool. The vulnerability allows remote attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML responses. Attackers can social-engineer users into fetching malicious URLs with pathological HTML structures. This causes server memory exhaustion and service unavailability. The vulnerability affects the web_fetch tool specifically and impacts the Gateway process.

Technical details

Mitigation steps:

Affected products:

OpenClaw