N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qcc3-jqwp-5vh2

GHSA-qcc3-jqwp-5vh2: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Summary

LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Current Maintainer Triage

Status: open
Normalized severity: low
Assessment: Shipped v2026.3.28 lacks a shared pre-auth concurrency budget on the public LINE webhook path, but the effect is bounded transient availability loss only, so low fits.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

57c47d8c7fbf5a2e70cc4dec2380977968903cad — 2026-03-31T19:34:25+09:00

OpenClaw thanks @nexrin for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qcc3-jqwp-5vh2

GHSA-qcc3-jqwp-5vh2:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-qcc3-jqwp-5vh2, is a resource exhaustion issue in the LINE webhook handler of OpenClaw. The root cause is the absence of a concurrency limit on the webhook endpoint before the request body is read and the signature is verified. An attacker could exploit this by sending a high volume of concurrent POST requests to the webhook, forcing the server to allocate resources for each request to read the body and perform cryptographic signature verification. This would lead to resource exhaustion and a denial of service for legitimate users.

The analysis of the patch commit 57c47d8c7fbf5a2e70cc4dec2380977968903cad confirms this. The changes in extensions/line/src/monitor.ts within the monitorLineProvider function show the introduction of a concurrency limiting mechanism. Previously, the route handler was directly assigned the function returned by createLineNodeWebhookHandler. The patch wraps this in a new handler that uses beginWebhookRequestPipelineOrReject to limit the number of in-flight requests before they are passed to the actual processing logic.

The function createLineNodeWebhookHandler in extensions/line/src/webhook-node.ts is also implicated as it creates the handler where the expensive, pre-authentication processing occurs. Therefore, during an exploit, profilers would show significant time spent within the anonymous handler function created by createLineNodeWebhookHandler, which is orchestrated and set up by monitorLineProvider.

Vulnerable functions

monitorLineProvider

extensions/line/src/monitor.ts

This function is responsible for setting up the LINE webhook. In the vulnerable version, it registered a request handler for the webhook path that did not have a concurrency limit. This allowed an attacker to send a large number of requests, consuming server resources before any authentication or signature verification, leading to a potential denial of service. The patch replaces the direct handler with a new one that implements a concurrency limit using `beginWebhookRequestPipelineOrReject`.

createLineNodeWebhookHandler

extensions/line/src/webhook-node.ts

This function creates the actual webhook request handler. The handler returned by this function performs resource-intensive operations like reading the request body and verifying the LINE webhook signature. In the vulnerable implementation, this handler was invoked without any preceding concurrency check, making it the focal point of the resource exhaustion attack. The patch modifies this function to accept an `onRequestAuthenticated` callback, allowing the concurrency lock to be released earlier in the request lifecycle, as part of the overall fix.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.