https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T23:51:30.597236+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-42437 CVE-2026-42437 — OpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path 2026-09-28T23:51:30.599377+00:00

Affected: OpenClaw

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the voice-call realtime WebSocket path.

 https://db.gcve.eu/vuln/ghsa-vw3h-q6xq-jjm5 GHSA-vw3h-q6xq-jjm5 — OpenClaw: Voice-call realtime WebSocket accepted oversized frames 2026-09-28T23:51:30.599457+00:00

Affected: npm: openclaw

## Summary

Voice-call realtime WebSocket accepted oversized frames.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.9 < 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The voice-call realtime WebSocket path could accept oversized frames, creating a remote availability risk for deployments exposing that webhook path.

## Technical Details

The fix rejects oversized realtime WebSocket frames before processing them.

## Fix

The issue was fixed in #63890. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `afadb7dae6738819ad9c7d2597ace0516957d20e` - PR: #63890

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Reporters

Thanks to G0odUser from ADLab of VenusTech Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.