Openclaw cli: OpenClaw has a Web Fetch DoS via unbounded response parsing (CVE-2026-28394)

The OpenClaw CLI web_fetch tool could be exploited to crash the OpenClaw Gateway process through resource exhaustion. This occurs when the tool fetches and attempts to parse attacker-controlled web pages with extremely large or pathologically nested HTML content, leading to out-of-memory conditions or unresponsiveness. The vulnerability affects openclaw versions from 2026.1.29 up to but not including 2026.2.15. The fix implemented in version 2026.2.15 caps the downloaded response body size before parsing and adds protections against pathological HTML during Readability/DOM parsing.

An attacker can induce a denial of service by tricking a user or automation that uses web_fetch into retrieving malicious URLs with oversized or deeply nested HTML responses. This causes the OpenClaw Gateway process to exhaust memory or become unresponsive, resulting in service disruption. There is no impact on confidentiality or integrity, only availability is affected.

A fix is available in openclaw version 2026.2.15 and later. Users should upgrade to this version or newer to mitigate the vulnerability. The fix limits the size of the response body before parsing and adds additional safeguards against pathological HTML structures. No further action is required once updated.