GHSA-c447-w54g-f55j
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-jq3f-vjww-8rq7. This link is maintained to preserve external references.
Original Description
OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version



Related Resources
References
https://github.com/openclaw/openclaw/security/advisories/GHSA-jq3f-vjww-8rq7, https://nvd.nist.gov/vuln/detail/CVE-2026-32980, https://github.com/openclaw/openclaw/commit/7e49e98f79073b11134beac27fdff547ba5a4a02, https://www.vulncheck.com/advisories/openclaw-resource-exhaustion-via-unauthenticated-telegram-webhook-request
