{"id":"CVE-2026-28478","aliases":["GHSA-q447-rj3r-2cgh"],"url":"https://o3.security/vulnerability/CVE-2026-28478","summary":"OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering","details":"### Summary\nMultiple webhook handlers accepted and buffered request bodies without a strict unified byte/time limit. A remote unauthenticated attacker could send oversized payloads and cause memory pressure, degrading availability.\n\n### Details\nAffected packages:\n- `openclaw` (npm): `<2026.2.12`\n- `clawdbot` (npm): `<=2026.1.24-3`\n\nRoot cause:\n- Webhook code paths buffered request payloads without consistent `maxBytes` + `timeoutMs` enforcement.\n- Some SDK-backed handlers parse request bodies internally and needed stream-level guards.\n\nAttack shape:\n- Send very large JSON payloads or slow/incomplete uploads to webhook endpoints.\n- Observe elevated memory usage and request handler pressure.\n\n### Impact\nRemote unauthenticated availability impact (DoS) via request body amplification/memory pressure.\n\n### Patch details (implemented)\n- Added shared bounded request-body helper in `src/infra/http-body.ts`.\n- Exported helper in `src/plugin-sdk/index.ts` for extension reuse.\n- Migrated webhook body readers to shared helper for:\n  - LINE\n  - Nextcloud Talk\n  - Google Chat\n  - Zalo\n  - BlueBubbles\n  - Nostr profile HTTP\n  - Voice-call\n  - Gateway hooks\n- Added stream guards for SDK handlers that parse request bodies internally:\n  - Slack\n  - Telegram\n  - Feishu\n- Added explicit Express JSON body limit handling for MS Teams webhook path.\n- Standardized failure responses:\n  - `413 Payload Too Large`\n  - `408 Request Timeout`\n\n### Tests\n- Added regression tests:\n  - `src/infra/http-body.test.ts`\n  - `src/line/monitor.read-body.test.ts`\n  - `extensions/nextcloud-talk/src/monitor.read-body.test.ts`\n- Focused webhook/security test suite passes for patched paths.\n\n### Remediation\nUpgrade to the first release containing this patch.\n\n## Credits\nThanks @vincentkoc for reporting.","published":"2026-03-05T21:59:53.887Z","modified":"2026-08-12T03:51:40.704347075Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.13"},{"ecosystem":"npm","name":"clawdbot","fixedVersion":null}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930","label":"openclaw/openclaw@3cbcba1"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28478.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q447-rj3r-2cgh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28478"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unbounded-webhook-request-body-buffering"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.704347075Z"}}