Openclaw cli: OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks (CVE-2026-29612)

The OpenClaw CLI suffers from a denial of service vulnerability (CVE-2026-29612) where base64-encoded media inputs are decoded into memory buffers prior to enforcing decoded size limits. Attackers can supply oversized base64 payloads that cause large memory allocations, leading to memory pressure and denial of service. The recommended deployment binds the gateway to loopback and requires authentication, limiting exploitation to local or authorized users. If the gateway is exposed to untrusted networks or authentication is weakened, the risk escalates to a network-level DoS. The vulnerability affects openclaw versions >=2026.1.29 and <2026.2.14 and clawdbot versions <=2026.1.24-3. A patch is planned for openclaw in version 2026.2.14; clawdbot has no planned patch and users should migrate to openclaw.

The vulnerability allows an attacker to cause denial of service by forcing large memory allocations through oversized base64 media inputs. This results in memory pressure that can disrupt service availability. There is no impact on confidentiality or integrity. The severity is medium with a CVSS score of 5.5, reflecting a local or authorized user attack vector with no privileges required but causing availability impact.

A fix is available in openclaw version 2026.2.14 (planned). Operators should upgrade to this version once released. For clawdbot users, migration to openclaw is recommended as no patch is planned. Deployments should maintain the gateway bound to loopback interfaces and require authentication to limit exposure. Avoid exposing the gateway to untrusted networks or weakening authentication and rate limiting controls.