Resource exhaustion in Openclaw
CVE-2026-28452
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (36.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Openclaw — versions 0
Weakness classification (CWE)
References
- github.com/openclaw/openclaw/security/advisories/GHSA-h89v-j3x9-8wqj (vendor-advisory, Patch, Vendor Advisory)
- github.com/openclaw/openclaw/commit/d3ee5deb87ee2ad0ab83c92c365611165423cb71 (Patch, patch)
- github.com/openclaw/openclaw/commit/5f4b29145c236d124524c2c9af0f8acd048fbdea (Patch, patch)
- www.vulncheck.com/advisories/openclaw-denial-of-service-via-unguarded-archive-e… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-28452?
- CVE-2026-28452 is a medium-severity vulnerability in Openclaw, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.5/10. Published 2026-03-05.
- How severe is CVE-2026-28452?
- Medium severity. CVSS v3 base score is 5.5 out of 10.