CVE-2026-35640

OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing before signature rejection.

Score

CVSS 3.1 7.5 High

Status

Analyzed - disclosure@vulncheck.com

Published

2026-04-09

Last modified

2026-06-23

Weaknesses

CWE-696

Affected products

• Openclaw (Openclaw)

References

• https://github.com/openclaw/openclaw/commit/5e8cb22176e9235e224be0bc530699261eb60e53
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3h52-cx59-c456
• https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unauthenticated-webhook-request-parsing