AI Threat Alert
A missing input-size guard in openclaw's realtime voice-call WebSocket path allows any unauthenticated remote attacker to send arbitrarily large frames, exhausting server memory or CPU and crashing the voice-call subsystem. With only 4 downstream npm dependents the blast radius is narrow, but the package has accumulated 135 CVEs—a pattern that signals systemic quality issues rather than an isolated oversight. There is no evidence of active exploitation (not in CISA KEV, no public PoC, EPSS unavailable), keeping operational urgency moderate. Teams running openclaw in voice-enabled AI agent deployments should upgrade to 2026.4.10 or later (current stable: 2026.4.14) immediately; if patching is not feasible, place a reverse proxy or WAF rule that enforces WebSocket frame-size limits on the affected path.
What is the risk?
MEDIUM. The vulnerability is trivially exploitable—crafting an oversized WebSocket frame requires no AI or cryptographic knowledge—but impact is limited to availability of the voice-call feature rather than confidentiality or integrity. No public exploit or scanner template exists. The absence of EPSS data and KEV listing suggests low current exploitation interest. The 135-CVE history of the package elevates systemic risk; defenders should treat it as a high-debt dependency.
How does the attack unfold?
What systems are affected?
How severe is it?
What should I do?
4 steps-
PATCH
Upgrade openclaw to >=2026.4.10 (npm). Current stable is 2026.4.14 which includes the fix.
-
WORKAROUND
If patching is blocked, configure a reverse proxy (nginx, Caddy, AWS ALB) to enforce a maximum WebSocket frame size (e.g., nginx: proxy_read_timeout + limit_req, or frame-size enforcement at the TLS terminator) on the voice-call WebSocket path.
-
DETECT
Monitor for anomalously large WebSocket message payloads or sudden memory/CPU spikes on the openclaw process; alert on WebSocket frame sizes exceeding expected thresholds (typical voice frames are <64 KB).
-
ASSESS
Audit whether the voice-call WebSocket endpoint is internet-exposed vs. internal-only; restrict access via network controls if external exposure is unnecessary.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is GHSA-vw3h-q6xq-jjm5?
A missing input-size guard in openclaw's realtime voice-call WebSocket path allows any unauthenticated remote attacker to send arbitrarily large frames, exhausting server memory or CPU and crashing the voice-call subsystem. With only 4 downstream npm dependents the blast radius is narrow, but the package has accumulated 135 CVEs—a pattern that signals systemic quality issues rather than an isolated oversight. There is no evidence of active exploitation (not in CISA KEV, no public PoC, EPSS unavailable), keeping operational urgency moderate. Teams running openclaw in voice-enabled AI agent deployments should upgrade to 2026.4.10 or later (current stable: 2026.4.14) immediately; if patching is not feasible, place a reverse proxy or WAF rule that enforces WebSocket frame-size limits on the affected path.
Is GHSA-vw3h-q6xq-jjm5 actively exploited?
No confirmed active exploitation of GHSA-vw3h-q6xq-jjm5 has been reported, but organizations should still patch proactively.
How to fix GHSA-vw3h-q6xq-jjm5?
1. PATCH: Upgrade openclaw to >=2026.4.10 (npm). Current stable is 2026.4.14 which includes the fix. 2. WORKAROUND: If patching is blocked, configure a reverse proxy (nginx, Caddy, AWS ALB) to enforce a maximum WebSocket frame size (e.g., nginx: proxy_read_timeout + limit_req, or frame-size enforcement at the TLS terminator) on the voice-call WebSocket path. 3. DETECT: Monitor for anomalously large WebSocket message payloads or sudden memory/CPU spikes on the openclaw process; alert on WebSocket frame sizes exceeding expected thresholds (typical voice frames are <64 KB). 4. ASSESS: Audit whether the voice-call WebSocket endpoint is internet-exposed vs. internal-only; restrict access via network controls if external exposure is unnecessary.
What systems are affected by GHSA-vw3h-q6xq-jjm5?
This vulnerability affects the following AI/ML architecture patterns: AI voice agent deployments, real-time WebSocket-based agent frameworks, conversational AI pipelines, agentic orchestration systems with voice capabilities.
What is the CVSS score for GHSA-vw3h-q6xq-jjm5?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029 Denial of AI Service AML.T0034.001 Resource-Intensive Queries AML.T0034.002 Agentic Resource Consumption AML.T0049 Exploit Public-Facing Application Compliance Controls Affected
What are the technical details?
Original Advisory
## Summary Voice-call realtime WebSocket accepted oversized frames. ## Affected Packages / Versions - Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.9 < 2026.4.10` - Patched versions: `>= 2026.4.10` ## Impact The voice-call realtime WebSocket path could accept oversized frames, creating a remote availability risk for deployments exposing that webhook path. ## Technical Details The fix rejects oversized realtime WebSocket frames before processing them. ## Fix The issue was fixed in #63890. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix. ## Fix Commit(s) - `afadb7dae6738819ad9c7d2597ace0516957d20e` - PR: #63890 ## Release Process Note Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix. ## Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Exploitation Scenario
An adversary identifies an AI-powered voice agent (e.g., a customer service bot or CISO-facing briefing assistant) running openclaw. Using standard WebSocket tooling (wscat, Python websockets library), they connect to the exposed realtime voice-call WebSocket path and stream a sequence of frames each containing megabytes of arbitrary data. The server, lacking frame-size rejection, allocates memory for each frame before discarding it. Sustained at modest throughput, this exhausts the Node.js process heap, triggering an OOM crash or event-loop starvation. The voice AI agent becomes unavailable to all users. If the OpenClaw process is not supervised (e.g., no systemd restart), the outage persists until manual intervention.
Weaknesses (CWE)
CWE-400 Uncontrolled Resource Consumption
Primary
CWE-770 Allocation of Resources Without Limits or Throttling
Primary
CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.
- [Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- [Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-33579 9.9 OpenClaw: scope bypass escalates low-priv to admin
Same package: openclaw CVE-2026-32922 9.9 OpenClaw: privilege escalation to RCE via token scope bypass
Same package: openclaw CVE-2026-32038 9.8 Analysis pending
Same package: openclaw CVE-2026-30741 9.8 OpenClaw: RCE via request-side prompt injection
Same package: openclaw CVE-2026-53838 9.8 OpenClaw: approval scope bypass via reconnection state
Same package: openclaw