CVE-2026-41408

Katalog CVE

CVSS 6.5 · Medium EPSS 0,62%

Kerentanan Allocation of Resources Without Limits or Throttling pada openclaw. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations. Attackers can exhaust disk space by downloading media files without triggering intended safety restrictions, causing availability impact.

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-4g5x-2jfc-xm98 advisory vendor
• https://github.com/openclaw/openclaw/commit/2194587d70d2aef863508b945319c5a7c88b12ce patch
• https://www.vulncheck.com/advisories/openclaw-disk-exhaustion-via-media-download-bypass advisory pihak ketiga