OpenClaw présente une croissance mémoire non bornée dans le webhook Zalo via la variation des clés de la chaîne de requête (DoS non authentifié)

The primary impact of CVE-2026-28461 is a denial-of-service (DoS) condition. By repeatedly sending crafted webhook requests with varying query strings, an attacker can exhaust the available memory resources of the openclaw process. This memory exhaustion can manifest as process instability, slow response times, or ultimately, a complete crash of the service. The vulnerability's unauthenticated nature means that any attacker with network access to the Zalo webhook endpoint can potentially trigger this issue. While the vulnerability doesn't directly expose sensitive data, the resulting service disruption can have significant operational consequences.

Organizations utilizing openclaw in their Node.js applications, particularly those exposing Zalo webhook endpoints to the internet, are at risk. Shared hosting environments where multiple users share the same openclaw instance are also at increased risk, as an attacker could potentially exploit the vulnerability through another user's webhook integration.

• nodejs: Monitor openclaw process memory usage. High and rapidly increasing memory consumption could indicate exploitation.

ps aux | grep openclaw | awk '{print $6}' | sort -n | tail -1

• generic web: Monitor web server access logs for unusual patterns of requests to the Zalo webhook endpoint, particularly those with a large number of unique query parameters.

grep "/zalo_webhook" /var/log/apache2/access.log | awk '{print $7}' | sort | uniq -c | sort -nr | head -10

1. 2026-03-02Disclosure

   disclosure

1. Réservé2026-02-27
2. Publiée2026-03-02
3. Modifiée2026-04-02
4. EPSS mis à jour2026-03-26

The recommended mitigation for CVE-2026-28461 is to immediately upgrade openclaw to version 2026.3.1 or later. This version includes a fix that normalizes keys to matched webhook path semantics (excluding query strings) and bounds/prunes the tracking state, preventing unbounded memory growth. If upgrading is not immediately feasible, consider implementing rate limiting on the Zalo webhook endpoint to restrict the number of requests from a single source within a given timeframe. This can help to mitigate the impact of an attack by slowing down the rate at which memory is consumed. After upgrading, confirm the fix by sending multiple webhook requests with varying query strings and monitoring memory usage to ensure it remains within acceptable limits.