8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42437

CVE-2026-42437: OpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the voice-call realtime WebSocket path.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42437

CVE-2026-42437:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	>= 2026.4.9, < 2026.4.10	2026.4.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the openclaw package's handling of WebSocket connections for voice calls. Specifically, the RealtimeCallHandler.handleWebSocketUpgrade function, which manages the transition from HTTP to WebSocket, did not enforce a size limit on incoming WebSocket frames. This oversight allowed for a denial-of-service (DoS) vulnerability, as an attacker could send excessively large frames, causing the server to exhaust its memory and crash. The provided patch addresses this by introducing a maxPayload option in the WebSocketServer configuration within the handleWebSocketUpgrade function, effectively limiting the maximum size of a WebSocket frame to 256 KB. Any frame exceeding this limit is rejected before it can be processed, thus mitigating the DoS risk. The analysis of the commit afadb7dae6738819ad9c7d2597ace0516957d20e clearly shows the addition of this maxPayload setting as the fix, pinpointing RealtimeCallHandler.handleWebSocketUpgrade as the vulnerable function.

Vulnerable functions

RealtimeCallHandler.handleWebSocketUpgrade

extensions/voice-call/src/webhook/realtime-handler.ts

The `handleWebSocketUpgrade` function in the `RealtimeCallHandler` class is responsible for handling the upgrade of an HTTP connection to a WebSocket connection for real-time voice calls. Before the patch, the `WebSocketServer` was initialized without a `maxPayload` limit. This allowed an attacker to send oversized WebSocket frames, leading to excessive memory consumption and a potential denial-of-service (DoS) attack. The fix introduces a `maxPayload` limit of 256 KB, rejecting oversized frames before they are processed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.