https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 11:03:59 +0000 https://db.gcve.eu/vuln/cve-2026-29612 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.</p> https://db.gcve.eu/vuln/cve-2026-29612 https://db.gcve.eu/vuln/ghsa-w2cg-vxx6-5xjg <p><strong>Affected:</strong> npm: openclaw, npm: clawdbot</p> <p>## Summary</p> <p>Base64-backed media inputs could be decoded into Buffers before enforcing decoded-size budgets. An attacker supplying oversized base64 payloads can force large allocations, causing memory pressure and denial of service.</p> <p>## Attack Scenario Notes</p> <p>- Recommended deployments bind the gateway to loopback by default and require gateway auth for HTTP endpoints. In that configuration, this is best modeled as a local/authorized DoS. - If an operator exposes the gateway to untrusted networks (or disables/weakens auth and rate limits), treat this as a higher-severity network DoS risk.</p> <p>## Affected Packages / Versions</p> <p>- openclaw (npm): &lt;= 2026.2.13 - clawdbot (npm): &lt;= 2026.1.24-3</p> <p>## Fixed In</p> <p>- openclaw (npm): 2026.2.14 (planned) - clawdbot (npm): no patched release planned; migrate to openclaw</p> <p>## Fix Commit(s)</p> <p>- 31791233d60495725fa012745dde8d6ee69e9595</p> <p>## Credits Thanks @vincentkoc for reporting.</p> <p><strong>Affected:</strong> npm: openclaw, npm: clawdbot</p> <p>## Summary</p> <p>Base64-backed media inputs could be decoded into Buffers before enforcing decoded-size budgets. An attacker supplying oversized base64 payloads can force large allocations, causing memory pressure and denial of service.</p> <p>## Attack Scenario Notes</p> <p>- Recommended deployments bind the gateway to loopback by default and require gateway auth for HTTP endpoints. In that configuration, this is best modeled as a local/authorized DoS. - If an operator exposes the gateway to untrusted networks (or disables/weakens auth and rate limits), treat this as a higher-severity network DoS risk.</p> <p>## Affected Packages / Versions</p> <p>- openclaw (npm): &lt;= 2026.2.13 - clawdbot (npm): &lt;= 2026.1.24-3</p> <p>## Fixed In</p> <p>- openclaw (npm): 2026.2.14 (planned) - clawdbot (npm): no patched release planned; migrate to openclaw</p> <p>## Fix Commit(s)</p> <p>- 31791233d60495725fa012745dde8d6ee69e9595</p> <p>## Credits Thanks @vincentkoc for reporting.</p> https://db.gcve.eu/vuln/ghsa-w2cg-vxx6-5xjg