CVE-2026-42437: Openclaw

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the voice-call realtime WebSocket path.

Affected products

• Openclaw Openclaw: from 2026.4.9, before 2026.4.10 (fixed in 2026.4.10)

Published 2026-05-05. Last modified 2026-06-17.