Vulnerability · Published Sep 30, 2026 · Assigned by VulnCheck

CVE-2026-101881OpenClaw Windows Node before 2026.7.1 Denial of Service

Medium 6.5

In plain English

A medium-severity resource allocation without limits in OpenClaw Windows Node from OpenClaw. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 68.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes.

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw Windows Node	0 – before 2026.7.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-xxr2-xm56-9cw5) vendor-advisory
https://github.com/openclaw/openclaw-windows-node/commit/1810e357aa0d0639099b347f31c746ba7d31512a patch
OpenClaw Windows Node v2026.7.1 Release Notes release-notes
https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/WebSocketClientBase.cs#L217-L263 technical-description
VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Denial of Service third-party-advisory