Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-32062
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): HIGH
OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream
OpenClaw versions2026.2.21-2 prior to 2026.2.22 and @openclaw/voice-call versions 2026.2.21 prior to 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.
References
-
GitHub Security Advisory (GHSA-mfg5-7q5g-f37j) vendor-advisory
-
Patch Commit patch
Affected products
openclaw
- <2026.2.22
- ==2026.2.22
voice-call
- ==2026.2.22
- ==2026.2.21
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>