Openclaw cli: OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR) (CVE-2026-28452)
Description
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.14 are vulnerable to a denial of service caused by unguarded archive extraction. The vulnerability allows specially crafted ZIP or TAR archives with high expansion ratios to consume excessive CPU, memory, and disk resources during install or update operations. This can disrupt service availability. The issue is fixed by enforcing strict resource budgets on archive extraction, including limits on entry count, extracted bytes, and compressed archive size for ZIP files.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw CLI's archive extraction component (src/infra/archive.ts, extractArchive function) lacked strict resource limits, allowing attackers to supply ZIP or TAR archives that expand excessively during extraction. This leads to high CPU, memory, and disk consumption, resulting in denial of service. The fix introduces resource budgets that reject archives exceeding entry count, extracted byte limits, and compressed archive size (for ZIP). The vulnerability affects openclaw versions >=2026.1.29 and <2026.2.14 and clawdbot versions <=2026.1.24-3. The fix is committed in openclaw/openclaw repositories and will be included in upcoming npm releases.
Potential Impact
This vulnerability causes denial of service by allowing resource exhaustion during archive extraction. It does not impact confidentiality or integrity but can disrupt availability by consuming excessive system resources during install or update flows.
Mitigation Recommendations
A patch is available that enforces resource budgets on archive extraction to prevent excessive resource consumption. Users should upgrade to versions 2026.2.14 or later once the patched npm release is published. Until then, avoid extracting untrusted archives with OpenClaw CLI. Monitor the vendor advisory for the official patched release.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-28452
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245c912601ec6a3167f14
Added to database: 10/04/2026, 12:25:45 UTC
Last enriched: 10/04/2026, 13:10:48 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.