GHSA-4qwc-c7g9-4xcw: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure

March 26, 2026

Remote media HTTP error bodies were read without a hard size cap before failure handling, allowing unbounded allocation on error responses.

References

github.com/advisories/GHSA-4qwc-c7g9-4xcw
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/81445a901091a5d27ef0b56fceedbe4724566438
github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw

Code Behaviors & Features

Detect and mitigate GHSA-4qwc-c7g9-4xcw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →