{"action":"Upgrade openclaw to 2026.2.13 or later.","affected":[{"fixed":"2026.2.13","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-28478"],"ecosystem":"npm","epss":0.00507,"exploited":false,"fixed_versions":["2026.2.13"],"ghsa_id":"GHSA-q447-rj3r-2cgh","id":"tcs_01M5KG51WP6YT40R7YH53VXEWV","modified_at":"2026-03-05T22:11:21.439867Z","published_at":"2026-02-18T00:53:07Z","references":["https://osv.dev/vulnerability/GHSA-q447-rj3r-2cgh","https://github.com/openclaw/openclaw/security/advisories/GHSA-q447-rj3r-2cgh","https://github.com/openclaw/openclaw"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-q447-rj3r-2cgh","url":"https://osv.dev/vulnerability/GHSA-q447-rj3r-2cgh"}],"summary":"OpenClaw affected by denial of service via unbounded webhook request body buffering"}