{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2026.1.24-3"}],"component":"clawdbot","cve_ids":["CVE-2026-28478"],"ecosystem":"npm","epss":0.00463,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-q447-rj3r-2cgh","id":"tcs_01M5KG523QK16W86SW1J6TRCVG","modified_at":"2026-03-05T22:11:21.439867Z","published_at":"2026-02-18T00:53:07Z","references":["https://osv.dev/vulnerability/GHSA-q447-rj3r-2cgh","https://github.com/openclaw/openclaw/security/advisories/GHSA-q447-rj3r-2cgh","https://github.com/openclaw/openclaw"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-q447-rj3r-2cgh#npm/clawdbot","url":"https://osv.dev/vulnerability/GHSA-q447-rj3r-2cgh"}],"summary":"OpenClaw affected by denial of service via unbounded webhook request body buffering"}