OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames wi…

Published:

4 mei 2026 om 22:00:00

Alert date:

5 mei 2026 om 20:13:49

Source:

nvd.nist.gov

Web Technologies

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path. The vulnerability allows remote attackers to send oversized WebSocket frames without proper validation, causing service unavailability. This affects deployments that expose the webhook path. The vulnerability has been patched in version 2026.4.10. Multiple security advisories and commit references are available for this issue.

Technical details

Mitigation steps:

Affected products:

OpenClaw