CVE-2026-101881
OpenClaw Windows Node before 2026.7.1 Denial of Service
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes.
| CWE | CWE-770 |
| Vendor | openclaw |
| Product | openclaw windows node |
| Published | Sep 30, 2026 |
| Last Updated | Sep 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw windows node
Be the first to know when new medium vulnerabilities affecting openclaw openclaw windows node are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
OpenClaw / OpenClaw Windows Node
0 < 2026.7.1
References
github.com: https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-xxr2-xm56-9cw5 github.com: https://github.com/openclaw/openclaw-windows-node/commit/1810e357aa0d0639099b347f31c746ba7d31512a github.com: https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1 github.com: https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/WebSocketClientBase.cs#L217-L263 vulncheck.com: https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-denial-of-service
Credits
Cameron Beeley (anagnorisis2peripeteia)