PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32062 Openclaw CVE debrief

CVE-2026-32062 affects OpenClaw versions 2026.2.21-2 prior to 2026.2.22 and @openclaw/voice-call versions 2026.2.21 prior to 2026.2.22. The issue lets media-stream WebSocket upgrades complete before stream validation, so unauthenticated clients can keep idle sockets open and consume connection resources until service availability degrades.

Vendor
Openclaw
Product
Openclaw/voice-Call
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-11
Original CVE updated
2026-05-26
Advisory published
2026-03-11
Advisory updated
2026-05-26

Who should care

Operators and developers running OpenClaw or @openclaw/voice-call, especially internet-facing deployments that expose media-stream WebSocket endpoints or rely on connection capacity for legitimate streams.

Technical summary

The vulnerable behavior is an unauthenticated resource-exhaustion condition: the service accepts a WebSocket connection before it has validated the stream, which allows a remote client to hold pre-authenticated sockets open without completing a valid stream. NVD assigns CVSS 4.0 8.7 (HIGH) with network attack vector, no privileges, no user interaction, and availability impact only. The weakness is categorized as CWE-770 (Allocation of Resources Without Limits or Throttling). The affected ranges end before 2026.2.22 for both OpenClaw and @openclaw/voice-call.

Defensive priority

High priority for any exposed deployment. Update promptly if the service is reachable from untrusted networks or if connection exhaustion could affect voice/media availability.

Recommended defensive actions

  • Upgrade OpenClaw and @openclaw/voice-call to 2026.2.22 or later.
  • Restrict exposure of media-stream WebSocket endpoints to trusted clients and networks where possible.
  • Add or verify socket limits, request timeouts, rate limiting, and connection cleanup for pre-authenticated sessions.
  • Monitor for unusual growth in idle or pre-validation WebSocket connections and alert on connection pool saturation.
  • Review the vendor advisory and patch commit to confirm the fix is present in your deployed build.

Evidence notes

This debrief is based only on the supplied official and vendor-referenced corpus. NVD lists the vulnerable CPE ranges ending before 2026.2.22 and assigns CWE-770. The provided description states that media-stream WebSocket upgrades are accepted before stream validation, enabling unauthenticated clients to hold sockets open and degrade availability. The CVE was published on 2026-03-11 and last modified on 2026-05-12. No KEV listing was provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32062 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32062

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32062 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32062

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.