[openclaw] OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels

**[openclaw] OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels**

Summary OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection. Affected Packages / Versions Package: openclaw (npm) Affected versions: <= 2026.2.21-2 (latest published at triage time) Fixed in: 2026.2.22 (planned next release) Impact An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads. Fix Commit(s) 73d93dee64127a26f1acd09d0403b794cdeb4f5c Release Process Note patched_versions is pre-set to the planned next release (2026.2.22). After that npm release is published, this advisory can be published without further version-field edits...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.