[openclaw] OpenClaw has a Web Fetch DoS via unbounded response parsing

**[openclaw] OpenClaw has a Web Fetch DoS via unbounded response parsing**

Summary The web_fetch tool could be used to crash the OpenClaw Gateway process (OOM / resource exhaustion) by fetching and attempting to parse attacker-controlled web pages with oversized response bodies or pathological HTML nesting. Affected Packages / Versions Package: openclaw (npm) Affected versions: <= 2026.2.14 Fixed versions: >= 2026.2.15 Impact An attacker can social-engineer a user (or any automation that uses web_fetch) into fetching a malicious URL that returns extremely large or deeply nested HTML. The Gateway may exhaust memory or become unresponsive, causing a denial of service. Fix The Gateway now caps the downloaded response body size before any HTML parsing and adds additional guards to avoid running Readability/DOM parsing on pathological HTML. Fix Commit(s) 166cf6a3e04c7df42bea70a7ad5ce2b9df46d147 Release Process Note This advisory is prepared for the next npm release...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.