CVE-2026-28461: Openclaw DoS Vulnerability

CVE-2026-28461 Overview

CVE-2026-28461 is a Resource Exhaustion vulnerability affecting OpenClaw versions prior to 2026.3.1. The vulnerability exists in the Zalo webhook endpoint, which fails to properly constrain memory allocation when processing query string parameters. Unauthenticated remote attackers can exploit this flaw by sending repeated HTTP requests with varying query parameters, causing unbounded in-memory key accumulation that leads to memory exhaustion and denial of service conditions.

Critical Impact

Unauthenticated attackers can remotely cause service degradation, process instability, or complete out-of-memory conditions by exploiting the Zalo webhook endpoint, potentially disrupting availability for all users of affected OpenClaw deployments.

Affected Products

• OpenClaw versions prior to 2026.3.1
• OpenClaw for Node.js deployments
• Systems exposing the Zalo webhook endpoint to untrusted networks

Discovery Timeline

• 2026-03-19 - CVE-2026-28461 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-28461

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw stems from improper handling of query string parameters in the Zalo webhook endpoint. When the endpoint receives HTTP requests, it parses and stores query string keys in memory without implementing proper bounds checking or rate limiting mechanisms.

An attacker can craft requests with unique query parameter names on each request. Since the application accumulates these keys without enforcing limits on the number of stored entries or implementing garbage collection for stale entries, memory consumption grows unbounded. This attack requires no authentication, making it accessible to any network-connected adversary.

The network-based attack vector combined with low complexity requirements and no user interaction makes this vulnerability particularly dangerous for internet-facing OpenClaw deployments. The impact is confined to availability—there is no indication of confidentiality or integrity compromise.

Root Cause

The root cause is the absence of resource allocation limits in the query string parsing logic of the Zalo webhook handler. The application fails to:

1. Limit the maximum number of unique query parameter keys that can be stored in memory
2. Implement time-based expiration or eviction policies for accumulated keys
3. Provide rate limiting to prevent rapid accumulation from a single source
4. Validate or sanitize incoming query parameters before storage

This design oversight allows memory to grow proportionally with the number of unique query strings received, eventually exhausting available system memory.

Attack Vector

The attack is conducted over the network against the Zalo webhook endpoint. An attacker sends a high volume of HTTP requests, each containing query parameters with unique key names. The exploitation technique known as "query string key churn" works as follows:

The attacker targets the vulnerable webhook endpoint with requests containing randomized or incrementing query parameter names. Each unique key is stored in memory, and since no deduplication or eviction mechanism exists, memory consumption increases with each new request. The attack requires no authentication credentials and can be automated trivially.

The attacker continues sending requests until the target system experiences memory pressure symptoms including degraded performance, process crashes, or complete service unavailability due to out-of-memory conditions. For detailed technical analysis, refer to the VulnCheck Advisory.

Detection Methods for CVE-2026-28461

Indicators of Compromise

• Unusual memory growth patterns in OpenClaw Node.js processes without corresponding legitimate traffic increases
• High volume of HTTP requests to the Zalo webhook endpoint from single or distributed sources
• Requests containing abnormally large numbers of unique query parameters or randomized parameter names
• Application crashes or restarts due to out-of-memory conditions

Detection Strategies

• Monitor memory utilization trends for OpenClaw processes and alert on sustained growth patterns
• Implement request logging and analysis to identify patterns of requests with varied query strings to the webhook endpoint
• Deploy web application firewall rules to detect and block requests with excessive or suspicious query parameters
• Configure application performance monitoring to track memory allocation patterns in the Zalo webhook handler

Monitoring Recommendations

• Set up memory threshold alerts at 70%, 85%, and 95% utilization for systems running OpenClaw
• Enable access logging with query string capture for the Zalo webhook endpoint
• Implement anomaly detection for request patterns targeting webhook endpoints
• Monitor process restart events and OOM killer activity on hosting systems

How to Mitigate CVE-2026-28461

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.1 or later immediately
• If immediate upgrade is not possible, restrict network access to the Zalo webhook endpoint to trusted sources only
• Implement rate limiting at the reverse proxy or load balancer level for the affected endpoint
• Monitor memory usage closely on affected systems until the patch is applied

Patch Information

The vendor has addressed this vulnerability in OpenClaw version 2026.3.1. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Deploy a reverse proxy or web application firewall to limit query string complexity and enforce maximum parameter counts
• Implement IP-based rate limiting for the Zalo webhook endpoint to slow accumulation attacks
• Restrict access to the webhook endpoint via network segmentation or firewall rules
• Configure container or process memory limits to prevent a single compromised instance from affecting the host system

# Example nginx rate limiting configuration for the webhook endpoint
limit_req_zone $binary_remote_addr zone=webhook_limit:10m rate=10r/s;

location /webhook/zalo {
    limit_req zone=webhook_limit burst=20 nodelay;
    limit_req_status 429;
    
    # Limit query string length
    if ($query_string ~ "^.{1024,}$") {
        return 414;
    }
    
    proxy_pass http://openclaw_backend;
}