Nixpkgs security tracker

Dismissed

Permalink CVE-2026-32980

7.5 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): HIGH

updated 1 month ago by @mweinelt Activity log

Created suggestion 1 month ago
@mweinelt dismissed 1 month ago

OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.

References

GitHub Security Advisory (GHSA-jq3f-vjww-8rq7) third-party-advisory
Patch Commit patch
VulnCheck Advisory: OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request third-party-advisory

Affected products

OpenClaw

<2026.3.13
==2026.3.13

Matching in nixpkgs

pkgs.openclaw

Self-hosted, open-source AI assistant/agent

nixos-unstable 2026.3.12
- nixpkgs-unstable 2026.3.12
- nixos-unstable-small 2026.3.12

Package maintainers

@chrisportela Chris Portela <chris@chrisportela.com>

Fixed in https://github.com/nixos/nixpkgs/pull/499141

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.openclaw

Package maintainers