Openclaw cli: OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS (CVE-2026-32011)

OpenClaw CLI's webhook handlers for BlueBubbles and Google Chat accepted and parsed request bodies prior to performing authentication and signature verification in affected versions (<=2026.3.1). This flaw enables unauthenticated clients to initiate slow or oversized request bodies that keep parser resources occupied, leading to a slow-request denial of service (DoS). The vulnerability is tracked as CVE-2026-32011 and has a CVSS 3.1 score of 7.5 (high severity). The issue was resolved in version 2026.3.2 by enforcing authentication before body parsing, implementing strict pre-auth body and time budgets, and adding shared in-flight/request guardrails with regression test coverage.

An unauthenticated attacker can exploit this vulnerability to degrade the availability of the OpenClaw CLI webhook service by sending slow or oversized request bodies that consume parser resources. This results in a denial of service condition without requiring any authentication or valid signatures.

Upgrade OpenClaw CLI to version 2026.3.2 or later. This update enforces authentication before parsing request bodies on affected webhook paths, applies strict limits on pre-auth request body size and processing time, and introduces guardrails to prevent resource exhaustion. No other mitigation is required as the fix is available and should be applied promptly.