CVE-2026-35633

OpenClaw versions prior to 2026.3.22 contain an unbounded memory allocation vulnerability in remote media HTTP error handling that enables attackers to trigger excessive memory consumption and denial of service conditions. Attackers can exploit this by sending crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate memory without proper bounds checking before failure handling mechanisms activate. The vulnerability presents a medium severity risk with a CVSS score of 5.3, requiring only network access with no authentication or user interaction necessary to trigger the flaw. The attack vector is straightforward due to low complexity, though the impact is limited to availability, with no confidentiality or integrity compromise. The EPSS score of 0.0018 indicates this vulnerability ranks higher than approximately 99.6% of known CVEs in terms of exploitation likelihood. There is no current evidence of active exploitation in the wild, as the vulnerability has not been added to the Known Exploited Vulnerabilities catalog. The FAUCET risk score of 32.0 out of 100 and the inactive hot list status further suggest limited community attention and immediate threat activity. However, organizations running affected OpenClaw versions should prioritize patching to version 2026.3.22 or later as a routine security measure.