OpenClaw Denial-of-Service Vulnerability in Web Fetch Tool

A denial-of-service vulnerability has been identified in OpenClaw versions prior to 2026.2.15. The issue resides in the web_fetch tool, where attackers can cause the Gateway process to crash by exhausting memory. This is achieved by parsing oversized or deeply nested HTML responses. Remote attackers may social-engineer users into fetching malicious URLs that exploit this vulnerability, leading to service unavailability.

Impact

Exploitation of this vulnerability can cause the OpenClaw Gateway process to crash or become unresponsive, leading to a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by using the web_fetch tool to fetch a URL that returns a large or deeply nested HTML response. This can be done manually or by automating the process, such as through a browser extension that simulates user interactions.

Remediation

Users can update to OpenClaw version 2026.2.15 or later, where this vulnerability has been patched.