CVE-2026-32066

✕ Withdrawn — historical dataMEDIUMCVSS · not yet scored
—

OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)

Summary

Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route.

Impact

An attacker could cause memory pressure and potential process instability or OOM, degrading availability.

Fix

Webhook security tracking now normalizes keys to matched webhook path semantics (query excluded) and bounds/prunes tracking state to prevent unbounded growth.

Affected and Patched Versions

  • Affected: <= 2026.2.26
  • Patched: 2026.3.1

CVSS
—
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

March 2, 2026

Last Modified

March 2, 2026

Frequently asked(3)

What is CVE-2026-32066?
CVE-2026-32066 is a rejected CVE ID: its record was withdrawn on March 23, 2026 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected.
When was the CVE record for CVE-2026-32066 published?
The CVE record for CVE-2026-32066 was published on March 2, 2026. EchelonGraph's copy of the record carries a last-modified date of March 2, 2026; the record at its source may have been updated since.
How do I remediate CVE-2026-32066?
There is nothing to remediate under CVE-2026-32066: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.