CVE-2026-42420

Katalog CVE

CVSS 6.5 · Medium EPSS 0,55%

Kerentanan Allocation of Resources Without Limits or Throttling pada openclaw. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exploit multiple code paths to cause memory exhaustion or denial of service through crafted base64-encoded input.

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-ccx3-fw7q-rr2r advisory vendor
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 patch
• https://www.vulncheck.com/advisories/openclaw-improper-base64-decoding-size-validation advisory pihak ketiga