OpenClaw Unbounded Memory Growth Vulnerability in Zalo Webhook Endpoint Allowing Denial-of-Service

A vulnerability allowing unbounded memory growth has been identified in OpenClaw versions prior to 2026.3.1, specifically within the Zalo webhook endpoint. This vulnerability allows unauthenticated attackers to cause in-memory key accumulation by varying query strings in repeated requests. The exploitation of this vulnerability can lead to memory pressure, process instability, or out-of-memory conditions, all of which degrade service availability.

Impact

Exploitation of this vulnerability can cause significant memory pressure, leading to process instability or out-of-memory conditions, which degrade service availability.

Remediation

Users can update to OpenClaw version 2026.3.1 or later to address this vulnerability.