N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-x4vp-4235-65hg

GHSA-x4vp-4235-65hg: OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS

Impact

OpenClaw webhook handlers for BlueBubbles and Google Chat accepted and parsed request bodies before authentication and signature checks on vulnerable releases. This allowed unauthenticated clients to hold parser work open with slow/oversized request bodies and degrade availability (slow-request DoS).

Affected Packages / Versions

Package: openclaw (npm)
Affected releases: <= 2026.3.1
Latest published vulnerable version at triage time: 2026.3.1 (npm)
Fixed release: 2026.3.2 (released)

Fix Commit(s)

d3e8b17aa6432536806b4853edc7939d891d0f25

Mitigation

Upgrade to 2026.3.2 (or newer). The fix enforces auth-before-body for affected webhook paths, adds strict pre-auth body/time budgets, and introduces shared in-flight/request guardrails with regression coverage.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-x4vp-4235-65hg

GHSA-x4vp-4235-65hg:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.1	2026.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several webhook handlers (BlueBubbles, Google Chat, LINE) that parse or read the request body before performing authentication. This creates an opportunity for an unauthenticated attacker to cause a denial of service (DoS) through slow-request attacks, where they send a large request body very slowly, tying up server resources.

The analysis of the patch d3e8b17aa6432536806b4853edc7939d891d0f25 reveals a pattern of fixes across these handlers:

handleBlueBubblesWebhookRequest and handleGoogleChatWebhookRequest: The patch refactors these functions to perform authentication (checking for passwords or bearer tokens) before attempting to read the full request body. The vulnerable versions read the body first and authenticated second.
createLineNodeWebhookHandler: For this handler, the request body is required to validate the request's signature. The fix was to introduce and enforce much stricter pre-authentication limits on the size and read timeout of the request body. This minimizes the window for a DoS attack while still allowing the signature to be calculated.

The identified vulnerable functions are the primary entry points for these webhooks. During an exploit, these functions would be active, attempting to read the slow-moving request from the unauthenticated client, making them key indicators in a runtime profile or stack trace.

Vulnerable functions

handleBlueBubblesWebhookRequest

extensions/bluebubbles/src/monitor.ts

The function previously read the entire request body using `readBlueBubblesWebhookBody` before checking for authentication credentials (`guid` or `password`). This allowed an unauthenticated attacker to initiate a slow request, consuming server resources by sending a large body slowly, leading to a denial of service. The patch moves the authentication check before the body is read.

handleGoogleChatWebhookRequest

extensions/googlechat/src/monitor.ts

This function was vulnerable because it read and parsed the incoming JSON request body using `readJsonBodyWithLimit` before verifying the `Authorization` bearer token. For certain requests (Google Workspace Add-ons), the token was even extracted from the body itself. This allowed an unauthenticated user to send a slow or large request body, leading to resource exhaustion and a denial of service. The fix implements authentication checks before reading the full body, using a stricter 'pre-auth' body read profile when necessary.

createLineNodeWebhookHandler

src/line/webhook-node.ts

This function creates the webhook handler for LINE. LINE's signature verification requires the raw request body, so the body must be read before the signature can be validated. The vulnerability lies in the fact that the body was read with generous limits (up to 1MB with a 30s timeout) before authentication. An attacker could exploit this by sending a slow request without a valid signature. The patch mitigates this by applying much stricter body size and timeout limits (`LINE_WEBHOOK_PREAUTH_MAX_BODY_BYTES` and `LINE_WEBHOOK_PREAUTH_BODY_TIMEOUT_MS`) during this pre-authentication phase.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.