Nixpkgs Security Tracker

Untriaged

Permalink CVE-2026-32062

created 1 day ago

OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream

OpenClaw versions2026.2.21-2 prior to 2026.2.22 and @openclaw/voice-call versions 2026.2.21 prior to 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.

References

Patch Commit patch
VulnCheck Advisory: OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream third-party-advisory
GitHub Security Advisory (GHSA-mfg5-7q5g-f37j) vendor-advisory

Affected products

openclaw

<2026.2.22
==2026.2.22

voice-call

==2026.2.22
==2026.2.21

Matching in nixpkgs

pkgs.openclaw

Self-hosted, open-source AI assistant/agent

nixos-unstable 2026.2.26
- nixpkgs-unstable 2026.2.26
- nixos-unstable-small 2026.2.26

Package maintainers

@chrisportela Chris Portela <chris@chrisportela.com>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.openclaw

Package maintainers