GHSA-QCC3-JQWP-5VH2: GHSA-qcc3-jqwp-5vh2: Unauthenticated Resource Exhaustion via LINE Webhook Handler in OpenClaw

GHSA-qcc3-jqwp-5vh2: Unauthenticated Resource Exhaustion via LINE Webhook Handler in OpenClaw Vulnerability ID: GHSA-QCC3-JQWP-5VH2 CVSS Score: 5.3 Published: 2026-04-02 The OpenClaw personal AI assistant platform contains a resource exhaustion vulnerability in its LINE webhook handler. The application fails to enforce concurrency limits prior to processing unauthenticated HTTP POST requests, allowing an attacker to cause a Denial of Service (DoS) through rapid CPU and memory consumption. TL;DR Unauthenticated attackers can trigger severe Denial of Service in OpenClaw by sending high-concurrency requests to the LINE webhook handler. The lack of a pre-authentication resource budget causes the server to exhaust memory and CPU while performing cryptographic signature verification. Technical Details CWE IDs: CWE-400, CWE-770, CWE-347 Attack Vector: Network CVSS Score: 5.3 (Medium) Privileges Required: None User Interaction: None Impact: Denial of Service (Availability) Affected Systems Ope