CVE-2026-32066: OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)

March 2, 2026 (updated March 23, 2026)

Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route.

References

github.com/advisories/GHSA-wr6m-jg37-68xh
github.com/openclaw/openclaw
github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh
nvd.nist.gov/vuln/detail/CVE-2026-32066

Code Behaviors & Features

Detect and mitigate CVE-2026-32066 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →