CVE-2026-35633: OpenClaw unbounded memory alloc DoS

CISO Take

OpenClaw before 2026.3.22 fails to bound memory allocation when processing HTTP error response bodies from remote media endpoints, enabling unauthenticated network attackers to crash the agent process by delivering oversized error payloads. The CVSS score of 5.3 understates real exposure: no credentials, no user interaction, and network-accessible — and the EPSS percentile places this in the top 72% of all CVEs by relative exploitation likelihood, with 396 prior CVEs against this same package signaling a systemic pattern of poor input validation rather than an isolated defect. Upgrade immediately to OpenClaw 2026.3.22 (patches in commits 630f147 and 81445a9); as an interim control, enforce OS-level memory limits on the agent process via cgroups or ulimit and restrict media fetch targets to an allowlisted domain set.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium by CVSS but operationally elevated for AI agent deployments. The zero-credential, no-interaction attack surface is the key risk amplifier: any network-reachable OpenClaw instance can be taken down without prior foothold. Availability is the sole impact class, but in agentic pipelines where OpenClaw availability gates automated threat response, compliance evidence collection, or customer-facing workflows, a sustained DoS translates directly to business disruption. No public exploit and no KEV listing keep this below critical, but the 72nd-percentile EPSS positioning and the package's 396-CVE history warrant proactive patching over deferral. Overall: MEDIUM with elevated operational priority for environments where agent availability is load-bearing.

How does the attack unfold?

Reconnaissance

Adversary identifies a network-accessible OpenClaw agent instance and confirms a vulnerable pre-2026.3.22 version via HTTP headers, API responses, or public exposure scanning.

AML.T0006

Payload Positioning

Adversary either controls a malicious HTTP server directly or injects a crafted URL into the agent's task context via indirect prompt injection in retrieved web content, directing OpenClaw to make a media fetch request.

AML.T0051

Exploitation

The adversary's server returns an HTTP error response with an oversized body; OpenClaw allocates memory for the full payload before failure handling executes, exhausting available host RAM.

AML.T0049

Impact: DoS

The agent process is OOM-killed or becomes unresponsive, halting all in-flight agentic tasks and denying AI service to dependent workflows until the process is manually restarted.

AML.T0029

Reconnaissance

Adversary identifies a network-accessible OpenClaw agent instance and confirms a vulnerable pre-2026.3.22 version via HTTP headers, API responses, or public exposure scanning.

AML.T0006

Payload Positioning

Adversary either controls a malicious HTTP server directly or injects a crafted URL into the agent's task context via indirect prompt injection in retrieved web content, directing OpenClaw to make a media fetch request.

AML.T0051

Exploitation

The adversary's server returns an HTTP error response with an oversized body; OpenClaw allocates memory for the full payload before failure handling executes, exhausting available host RAM.

AML.T0049

Impact: DoS

The agent process is OOM-killed or becomes unresponsive, halting all in-flight agentic tasks and denying AI service to dependent workflows until the process is manually restarted.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A Low

What should I do?

5 steps

Upgrade OpenClaw to ≥ 2026.3.22 (commits 630f1479 and 81445a90 contain the fix).
If immediate patching is blocked, apply OS-level memory limits to the agent process (Linux: cgroup memory.limit_in_bytes or systemd MemoryMax=; macOS: launchd SoftResourceLimits).
Place a reverse proxy in front of media fetch paths and cap HTTP response body size (nginx: proxy_max_temp_file_size + client_max_body_size).
Restrict OpenClaw's remote media fetching to an allowlisted set of trusted domains to eliminate attacker-controlled endpoint exposure.
Monitor agent process RSS and OOM events (dmesg, /var/log/syslog, or container memory metrics) as a detection signal for exploitation attempts.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent AML.T0029 - Denial of AI Service AML.T0034.002 - Agentic Resource Consumption AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

Clause 6.1 - Actions to address risks and opportunities

NIST AI RMF

MANAGE 1.3 - Responses to the AI risks deemed high are developed, planned, and documented

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-35633?

OpenClaw before 2026.3.22 fails to bound memory allocation when processing HTTP error response bodies from remote media endpoints, enabling unauthenticated network attackers to crash the agent process by delivering oversized error payloads. The CVSS score of 5.3 understates real exposure: no credentials, no user interaction, and network-accessible — and the EPSS percentile places this in the top 72% of all CVEs by relative exploitation likelihood, with 396 prior CVEs against this same package signaling a systemic pattern of poor input validation rather than an isolated defect. Upgrade immediately to OpenClaw 2026.3.22 (patches in commits 630f147 and 81445a9); as an interim control, enforce OS-level memory limits on the agent process via cgroups or ulimit and restrict media fetch targets to an allowlisted domain set.

Is CVE-2026-35633 actively exploited?

No confirmed active exploitation of CVE-2026-35633 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35633?

1. Upgrade OpenClaw to ≥ 2026.3.22 (commits 630f1479 and 81445a90 contain the fix). 2. If immediate patching is blocked, apply OS-level memory limits to the agent process (Linux: cgroup memory.limit_in_bytes or systemd MemoryMax=; macOS: launchd SoftResourceLimits). 3. Place a reverse proxy in front of media fetch paths and cap HTTP response body size (nginx: proxy_max_temp_file_size + client_max_body_size). 4. Restrict OpenClaw's remote media fetching to an allowlisted set of trusted domains to eliminate attacker-controlled endpoint exposure. 5. Monitor agent process RSS and OOM events (dmesg, /var/log/syslog, or container memory metrics) as a detection signal for exploitation attempts.

What systems are affected by CVE-2026-35633?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, tool-augmented LLM agents, AI agent pipelines, web-retrieval RAG pipelines.

What is the CVSS score for CVE-2026-35633?

CVE-2026-35633 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworkstool-augmented LLM agentsAI agent pipelinesweb-retrieval RAG pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.002 Agentic Resource Consumption

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: Clause 6.1

NIST AI RMF: MANAGE 1.3

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate unbounded memory before failure handling occurs.

Exploitation Scenario

An adversary who controls a web server — or who can position a malicious URL into the OpenClaw agent's task context via indirect prompt injection in retrieved content — serves an HTTP 5xx error response with a multi-gigabyte body to the agent's media fetch request. OpenClaw allocates memory for the entire error body before its failure handler executes, exhausting available host RAM and triggering an OOM kill of the agent process. In a fully agentic chain, this can be triggered without direct access: a crafted web page retrieved during an agent browse task injects a follow-up URL instruction (AML.T0051.001), causing the agent to self-deliver the oversized payload and terminate.

Weaknesses (CWE)

CWE-789 Memory Allocation with Excessive Size Value

CWE-789 — Memory Allocation with Excessive Size Value: The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

[Implementation, Architecture and Design] Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
[Operation] Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

Source: MITRE CWE corpus.