CVE-2026-41334
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Apr 23, 2026
CISA due date
—
The record
OpenClaw before 2026.3.31 contains a decompression bomb vulnerability in image processing that fails to properly enforce pixel-limit guards on sips. Attackers can exploit this by uploading oversized images to cause denial of service through excessive memory consumption.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-88831 BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed… CWE-636
- CVE-2026-81379 Not failing securely ('failing open') in Visual Studio Code allows an unauthorized… CWE-636
- CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password… CWE-636
- CVE-2026-18329 Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a… CWE-636
- CVE-2026-82744 Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor… CWE-636
- CVE-2026-46482 ### Impact The registration component does not validate the text-based _Security… CWE-636
- CVE-2026-70452 rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows… CWE-636
- CVE-2026-54291 pgjdbc is an open source postgresql JDBC Driver. CWE-636