https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T11:04:02.623040+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-29612 CVE-2026-29612 — OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding 2026-09-30T11:04:02.625259+00:00

Affected: OpenClaw

OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.

 https://db.gcve.eu/vuln/ghsa-w2cg-vxx6-5xjg GHSA-w2cg-vxx6-5xjg — OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks 2026-09-30T11:04:02.625555+00:00

Affected: npm: openclaw, npm: clawdbot

## Summary

Base64-backed media inputs could be decoded into Buffers before enforcing decoded-size budgets. An attacker supplying oversized base64 payloads can force large allocations, causing memory pressure and denial of service.

## Attack Scenario Notes

- Recommended deployments bind the gateway to loopback by default and require gateway auth for HTTP endpoints. In that configuration, this is best modeled as a local/authorized DoS. - If an operator exposes the gateway to untrusted networks (or disables/weakens auth and rate limits), treat this as a higher-severity network DoS risk.

## Affected Packages / Versions

- openclaw (npm): <= 2026.2.13 - clawdbot (npm): <= 2026.1.24-3

## Fixed In

- openclaw (npm): 2026.2.14 (planned) - clawdbot (npm): no patched release planned; migrate to openclaw

## Fix Commit(s)

- 31791233d60495725fa012745dde8d6ee69e9595

## Credits Thanks @vincentkoc for reporting.