5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-w2cg-vxx6-5xjg

GHSA-w2cg-vxx6-5xjg: OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks

Summary

Base64-backed media inputs could be decoded into Buffers before enforcing decoded-size budgets. An attacker supplying oversized base64 payloads can force large allocations, causing memory pressure and denial of service.

Attack Scenario Notes

Recommended deployments bind the gateway to loopback by default and require gateway auth for HTTP endpoints. In that configuration, this is best modeled as a local/authorized DoS.
If an operator exposes the gateway to untrusted networks (or disables/weakens auth and rate limits), treat this as a higher-severity network DoS risk.

Affected Packages / Versions

openclaw (npm): <= 2026.2.13
clawdbot (npm): <= 2026.1.24-3

Fixed In

openclaw (npm): 2026.2.14 (planned)
clawdbot (npm): no patched release planned; migrate to openclaw

Fix Commit(s)

31791233d60495725fa012745dde8d6ee69e9595

Credits

Thanks @vincentkoc for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-w2cg-vxx6-5xjg

GHSA-w2cg-vxx6-5xjg:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.14	2026.2.14
clawdbot	npm	<= 2026.1.24-3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (GHSA-w2cg-vxx6-5xjg) is a denial-of-service in the OpenClaw platform caused by uncontrolled resource consumption (CWE-400). The root cause is the premature decoding of base64-encoded media files and chat attachments. Attacker-controlled input in base64 format was decoded into a raw Buffer before the application checked if the resulting data would exceed the configured size limits.

The analysis of the fix commit 31791233d60495725fa012745dde8d6ee69e9595 reveals several functions responsible for handling these base64 inputs.

In src/gateway/chat-attachments.ts, the functions parseMessageWithAttachments and buildMessageWithAttachments were modified. The vulnerable code, Buffer.from(b64, "base64"), which performs the decoding and memory allocation, was previously called before any size validation. The patch replaces this with a call to a new estimateBase64DecodedBytes function, which safely calculates the potential size from the base64 string's length without decoding it. If the estimated size is too large, the operation is aborted, preventing the large allocation.

Similarly, while the diff for src/media/input-files.ts doesn't show the function bodies, the corresponding test file (src/media/input-files.fetch-guard.test.ts) was updated to explicitly verify that extractImageContentFromSource and extractFileContentFromSource no longer call Buffer.from(..., "base64") for oversized inputs. This confirms these functions were also vulnerable and were fixed to perform size estimation before decoding.

Finally, the original estimateBase64DecodedBytes function in src/media/input-files.ts was itself a minor source of allocation pressure, as it used string.trim().replace() on the input. The fix introduces a more efficient, non-allocating estimation algorithm in a new src/media/base64.ts module, which is used by all the patched functions.

Therefore, during exploitation, a profiler would show one of parseMessageWithAttachments, buildMessageWithAttachments, extractImageContentFromSource, or extractFileContentFromSource at the top of the stack, consuming significant CPU and memory while trying to allocate a large buffer from the malicious base64 input.

Vulnerable functions

parseMessageWithAttachments

src/gateway/chat-attachments.ts

This function decodes a base64 string into a Buffer before checking its size. An attacker can provide a large base64 string, forcing a large memory allocation and causing a denial of service.

buildMessageWithAttachments

src/gateway/chat-attachments.ts

Similar to `parseMessageWithAttachments`, this function decodes a base64 string into a Buffer before validating its size, exposing the system to a denial of service through excessive memory allocation.

extractImageContentFromSource

src/media/input-files.ts

This function processes base64-encoded images. The patch's test file confirms that prior to the fix, the function would call `Buffer.from` (and thus allocate a large buffer) before checking size limits. This allowed for a DoS attack via memory exhaustion.

extractFileContentFromSource

src/media/input-files.ts

This function processes generic base64-encoded files. Like the other vulnerable functions, it decoded the entire base64 payload before size validation, creating a vector for a memory-based denial of service attack. The test file for the patch confirms this behavior was fixed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-w2cg-vxx6-5xjg: OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks

Summary

Attack Scenario Notes

Affected Packages / Versions

Fixed In

Fix Commit(s)

Credits

GHSA-w2cg-vxx6-5xjg:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

GHSA-w2cg-vxx6-5xjg: OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks

Summary

Attack Scenario Notes

Affected Packages / Versions

Fixed In

Fix Commit(s)

Credits

5.5

5.5

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI