Medium severity · published Sep 30, 2026
CVE-2026-101881
OpenClaw Windows Node before 2026.7.1 Denial of Service
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OW
OpenClaw Windows Node · OpenClaw
before 2026.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101881
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101881
vendor-advisory
https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-xxr2-xm56-9cw5
patch
https://github.com/openclaw/openclaw-windows-node/commit/1810e357aa0d0639099b347f31c746ba7d31512a
release-notes
https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1
technical-description
https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/WebSocketClientBase.cs#L217-L263
third-party-advisory
https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-denial-of-service
More from OpenClaw Windows Node
8.8
CVE-2026-101882
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
8.8
CVE-2026-101880
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
7.5
CVE-2026-101884
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
6.5
CVE-2026-101879
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
5.4
CVE-2026-101883
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present