CVE-2026-29612

MEDIUM 5.5

OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.

CWE	CWE-770
Vendor	openclaw
Product	openclaw
Published	Mar 5, 2026
Last Updated	Mar 9, 2026

Stay Ahead of the Next One

Get instant alerts for openclaw openclaw

Be the first to know when new medium vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

OpenClaw / OpenClaw

0 < 2026.2.14

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-w2cg-vxx6-5xjg github.com: https://github.com/openclaw/openclaw/commit/31791233d60495725fa012745dde8d6ee69e9595 vulncheck.com: https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-large-base-media-file-decoding

Credits

🔍 Vincent Koc (@vincentkoc)