CVE-2026-28452
Medium · 5.5CVSS
5.5
EPSS
0.5%
Published
Mar 5, 2026
CISA due date
—
The record
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | clawdbot | 0 | No fix |
| npm | openclaw | 0 | 2026.2.14 |
Related vulnerabilities
- GHSA-h89v-j3x9-8wqj OpenClaw affected by denial of service through unguarded archive extraction allowing high… Same vulnerability
- CVE-2026-29612 OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers… Also affects clawdbot
- CVE-2026-28480 OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where… Also affects clawdbot
- CVE-2026-28478 OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook… Also affects clawdbot
- CVE-2026-28469 OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the… Also affects clawdbot
- CVE-2026-26328 OpenClaw is a personal AI assistant. Also affects clawdbot
- CVE-2026-26317 OpenClaw is a personal AI assistant. Also affects clawdbot
- GHSA-mj5r-hh7j-4gxf OpenClaw Telegram allowlist authorization accepted mutable usernames Also affects clawdbot