CVE-2026-35640

CVE-2026-35640 is a denial of service vulnerability affecting OpenClaw versions prior to 2026.3.25. The flaw stems from the application parsing JSON request bodies before validating webhook signatures, enabling unauthenticated attackers to trigger resource exhaustion by submitting malicious webhook requests that force computationally intensive parsing operations. The vulnerability carries a HIGH severity rating with a CVSS score of 7.5, reflecting its network-based attack vector requiring no authentication or user interaction. While the attack is trivial to execute with low complexity, the impact is limited to availability, as the vulnerability does not compromise confidentiality or integrity. An attacker can cause denial of service by exhausting server resources through repeated malicious webhook submissions. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on public hotlists. However, with an EPSS score of 0.0012, the exploit probability is minimal relative to the broader vulnerability landscape. Organizations running affected OpenClaw versions should prioritize patching to version 2026.3.25 or later to prevent potential DoS attacks.