https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T02:49:52.197288+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-28452 CVE-2026-28452 — OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive 2026-09-30T02:49:52.198385+00:00

Affected: OpenClaw

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.

 https://db.gcve.eu/vuln/ghsa-h89v-j3x9-8wqj GHSA-h89v-j3x9-8wqj — OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP… 2026-09-30T02:49:52.198452+00:00

Affected: npm: openclaw, npm: clawdbot

## Summary Archive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows.

## Affected Packages / Versions - openclaw (npm): <= 2026.2.13 - clawdbot (npm): <= 2026.1.24-3

## Details Affected component: `src/infra/archive.ts` (`extractArchive`).

The extractor now enforces resource budgets (entry count and extracted byte limits; ZIP also enforces a compressed archive size limit) and rejects over-budget archives.

## Fix Commit(s) - openclaw/openclaw@d3ee5deb87ee2ad0ab83c92c365611165423cb71 - openclaw/openclaw@5f4b29145c236d124524c2c9af0f8acd048fbdea

## Release Process Note This advisory will be updated with patched versions once the next npm release containing the fix is published.

## Credits Thanks @vincentkoc for reporting.