OpenClaw 在 Zalo webhook 中存在无边界内存增长，通过查询字符串键轮换 (未认证 DoS)

The primary impact of CVE-2026-28461 is a denial-of-service (DoS) condition. By repeatedly sending crafted webhook requests with varying query strings, an attacker can exhaust the available memory resources of the openclaw process. This memory exhaustion can manifest as process instability, slow response times, or ultimately, a complete crash of the service. The vulnerability's unauthenticated nature means that any attacker with network access to the Zalo webhook endpoint can potentially trigger this issue. While the vulnerability doesn't directly expose sensitive data, the resulting service disruption can have significant operational consequences.

Organizations utilizing openclaw in their Node.js applications, particularly those exposing Zalo webhook endpoints to the internet, are at risk. Shared hosting environments where multiple users share the same openclaw instance are also at increased risk, as an attacker could potentially exploit the vulnerability through another user's webhook integration.

• nodejs: Monitor openclaw process memory usage. High and rapidly increasing memory consumption could indicate exploitation.

ps aux | grep openclaw | awk '{print $6}' | sort -n | tail -1

• generic web: Monitor web server access logs for unusual patterns of requests to the Zalo webhook endpoint, particularly those with a large number of unique query parameters.

grep "/zalo_webhook" /var/log/apache2/access.log | awk '{print $7}' | sort | uniq -c | sort -nr | head -10

1. 2026-03-02Disclosure

   disclosure

1. 已保留2026-02-27
2. 发布日期2026-03-02
3. 修改日期2026-04-02
4. EPSS 更新日期2026-03-26

The recommended mitigation for CVE-2026-28461 is to immediately upgrade openclaw to version 2026.3.1 or later. This version includes a fix that normalizes keys to matched webhook path semantics (excluding query strings) and bounds/prunes the tracking state, preventing unbounded memory growth. If upgrading is not immediately feasible, consider implementing rate limiting on the Zalo webhook endpoint to restrict the number of requests from a single source within a given timeframe. This can help to mitigate the impact of an attack by slowing down the rate at which memory is consumed. After upgrading, confirm the fix by sending multiple webhook requests with varying query strings and monitoring memory usage to ensure it remains within acceptable limits.