OpenClaw Unbounded Memory Growth Vulnerability in Zalo Webhook Endpoint Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in OpenClaw versions prior to 2026.3.1. This issue arises in the Zalo webhook endpoint, where unauthenticated attackers can cause memory exhaustion by sending repeated requests with varying query parameters. This unbounded accumulation of in-memory keys leads to increased memory usage, process instability, and potential out-of-memory conditions.

Impact

Exploitation of this vulnerability causes unbounded memory growth, leading to memory pressure, process instability, or out-of-memory conditions.

Remediation

Users can upgrade to OpenClaw version 2026.3.1 or later to address this vulnerability.