GHSA-f44p-c7w9-7xr7
OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget.
## Impact
An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients.
## Affected Component
`src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.ts`
## Fixed Versions
- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.
## Fix
Fixed by commit `cb5f7e201f` (`gateway: cap concurrent pre-auth websocket upgrades`).
Discovered by：Topsec AlphaLab (wang dong)
References
External links from the advisory. They lead to third-party sites.