CVE-2026-32049: OpenClaw media limit bypass enables

CISO Take

OpenClaw versions before 2026.2.22 fail to consistently enforce configured inbound media byte limits across all channel ingestion paths, allowing unauthenticated remote attackers to exhaust process memory and crash the service with a trivially crafted oversized payload—no credentials, no user interaction, no special tooling required. With CVSS 7.5 and a fully network-accessible attack surface, any AI agent deployment exposing OpenClaw's media ingestion channels is at risk; 4 downstream dependents extend the availability blast radius beyond direct users. EPSS of 0.54% places this in the top 59% of CVEs for exploitation likelihood, though no active exploitation, KEV listing, or public exploit currently exists. Upgrade to OpenClaw 2026.2.22 immediately; if patching is blocked, enforce strict payload size limits upstream via WAF or API gateway covering all ingestion channels—not just the primary path—and apply container-level memory constraints to contain blast radius.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High severity, trivially exploitable DoS with no authentication barrier and low attack complexity makes this accessible to unsophisticated attackers at scale. The inconsistency spans multiple ingestion paths rather than a single endpoint, meaning a partial fix that hardens only one channel may leave others exposed. The 396 existing CVEs in this package signals a historically vulnerability-prone component warranting heightened scrutiny in any AI agent stack audit. Risk is exclusively availability-focused—CVSS confirms C:N/I:N/A:H—but for AI agent pipelines where OpenClaw orchestrates automated workflows, a process crash translates directly to business process disruption.

How does the attack unfold?

Reconnaissance

Attacker identifies a publicly accessible OpenClaw deployment and enumerates the available media ingestion channel paths to locate one with inconsistent byte limit enforcement.

AML.T0006

Payload Delivery

Attacker sends a stream of oversized media payloads to the under-protected ingestion channel, bypassing the configured byte limit and forcing unbounded memory buffering.

AML.T0049

Resource Exhaustion

Sustained delivery of oversized payloads progressively consumes available process memory until OpenClaw becomes unstable or crashes.

AML.T0034.001

Service Disruption

OpenClaw process crash denies service to all dependent AI agent workflows and automated task orchestration pipelines, achieving the attacker's availability impact.

AML.T0029

Reconnaissance

Attacker identifies a publicly accessible OpenClaw deployment and enumerates the available media ingestion channel paths to locate one with inconsistent byte limit enforcement.

AML.T0006

Payload Delivery

Attacker sends a stream of oversized media payloads to the under-protected ingestion channel, bypassing the configured byte limit and forcing unbounded memory buffering.

AML.T0049

Resource Exhaustion

Sustained delivery of oversized payloads progressively consumes available process memory until OpenClaw becomes unstable or crashes.

AML.T0034.001

Service Disruption

OpenClaw process crash denies service to all dependent AI agent workflows and automated task orchestration pipelines, achieving the attacker's availability impact.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.2.22 or later per vendor advisory GHSA-rxxp-482v-7mrh and the associated commit (73d93de).
Compensating control: If patching is blocked, enforce strict request payload size limits upstream via WAF, Nginx client_max_body_size, or API gateway rules—critically, apply these rules to all ingestion channel paths, not only the primary endpoint.
Resource isolation: Apply container or process-level memory limits (Docker --memory flag, cgroup limits, ulimit) to prevent a single instance from exhausting host memory.
Detection: Alert on anomalous memory growth trends or OOM events in OpenClaw processes; implement health checks with auto-restart to reduce mean time to recovery.
Post-patch validation: Explicitly test byte limit enforcement across all alternative ingestion channels after upgrading to confirm the inconsistency is fully resolved.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

8.4 - AI system design 9.1 - Monitoring, measurement, analysis and evaluation

NIST AI RMF

MANAGE 2.2 - Mechanisms to respond to and recover from AI risks

OWASP LLM Top 10

LLM04 - Model Denial of Service

Frequently Asked Questions

What is CVE-2026-32049?

OpenClaw versions before 2026.2.22 fail to consistently enforce configured inbound media byte limits across all channel ingestion paths, allowing unauthenticated remote attackers to exhaust process memory and crash the service with a trivially crafted oversized payload—no credentials, no user interaction, no special tooling required. With CVSS 7.5 and a fully network-accessible attack surface, any AI agent deployment exposing OpenClaw's media ingestion channels is at risk; 4 downstream dependents extend the availability blast radius beyond direct users. EPSS of 0.54% places this in the top 59% of CVEs for exploitation likelihood, though no active exploitation, KEV listing, or public exploit currently exists. Upgrade to OpenClaw 2026.2.22 immediately; if patching is blocked, enforce strict payload size limits upstream via WAF or API gateway covering all ingestion channels—not just the primary path—and apply container-level memory constraints to contain blast radius.

Is CVE-2026-32049 actively exploited?

No confirmed active exploitation of CVE-2026-32049 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32049?

1. Patch: Upgrade OpenClaw to version 2026.2.22 or later per vendor advisory GHSA-rxxp-482v-7mrh and the associated commit (73d93de). 2. Compensating control: If patching is blocked, enforce strict request payload size limits upstream via WAF, Nginx client_max_body_size, or API gateway rules—critically, apply these rules to all ingestion channel paths, not only the primary endpoint. 3. Resource isolation: Apply container or process-level memory limits (Docker --memory flag, cgroup limits, ulimit) to prevent a single instance from exhausting host memory. 4. Detection: Alert on anomalous memory growth trends or OOM events in OpenClaw processes; implement health checks with auto-restart to reduce mean time to recovery. 5. Post-patch validation: Explicitly test byte limit enforcement across all alternative ingestion channels after upgrading to confirm the inconsistency is fully resolved.

What systems are affected by CVE-2026-32049?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-channel media ingestion pipelines, Automated AI task orchestration.

What is the CVSS score for CVE-2026-32049?

CVE-2026-32049 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.54%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-channel media ingestion pipelinesAutomated AI task orchestration

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: 8.4, 9.1

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage and potential process instability.

Exploitation Scenario

An adversary identifies a production OpenClaw deployment through passive scanning of AI agent infrastructure or public threat intelligence feeds. They probe the service's documented and undocumented media ingestion channels to locate one where the configured byte limit check is inconsistently applied—for example, a secondary media type handler or an alternate protocol ingestion path. The attacker begins sending a stream of oversized media payloads to this endpoint in a loop; each payload is buffered in memory without rejection, progressively exhausting available RAM. Within minutes, the OpenClaw process becomes unstable or terminates, disabling all dependent AI agent workflows and task orchestration. The attack requires no credentials, no AI/ML domain knowledge, and is fully automatable, making it viable for opportunistic scanning campaigns targeting exposed AI agent infrastructure.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.