CVE-2026-35640

Katalog CVE

CVSS 7.5 · High EPSS 0,79%

Kerentanan Incorrect Behavior Order pada openclaw. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing before signature rejection.

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-696: Incorrect Behavior Order

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3h52-cx59-c456 advisory vendor
• https://github.com/openclaw/openclaw/commit/5e8cb22176e9235e224be0bc530699261eb60e53 patch
• https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unauthenticated-webhook-request-parsing advisory pihak ketiga