Answer in brief
CVE-2026-32062 records a High severity (CVSS 7.5) vulnerability in OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure. The current sources do not mark it as known exploited. The current feed maps openclaw (npm), openclaw (npm), @openclaw/voice-call (npm), @openclaw/voice-call (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps openclaw (npm), openclaw (npm), @openclaw/voice-call (npm), @openclaw/voice-call (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| openclawnpm | <2026.2.22 | 2026.2.22 |
| openclawnpm | >=0 <2026.2.22 | 2026.2.22 |
| @openclaw/voice-callnpm | <2026.2.22 | 2026.2.22 |
| @openclaw/voice-callnpm | >=0 <2026.2.22 | 2026.2.22 |
Published upstream
Mar 2, 2026
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
### Summary `@openclaw/voice-call` (and the bundled copy shipped in `openclaw`) accepted media-stream WebSocket upgrades before stream validation. In reachable deployments, unauthenticated pre-start sockets could be held open and increase resource pressure. ### Affected Packages / Versions - `openclaw` (npm): vulnerable `<= 2026.2.21-2`, patched in `2026.2.22`. - `@openclaw/voice-call` (npm): vulnerable `<= 2026.2.21`, patched in `2026.2.22`. ### Technical Details Before this fix, the voice-call media-stream path upgraded sockets first and ran `shouldAcceptStream()` after a later `start` frame. This created a pre-auth window where remote clients could hold idle sockets without call/token validation. ### Impact Availability risk in deployments where the media-stream endpoint is reachable and streaming is enabled. Under sustained abuse, this could consume connection-related resources and degrade service for legitimate streams. ### Remediation The fix adds layered controls in the media-stream path: - strict pre-start timeout (close sockets that do not send a valid `start` frame quickly) - global pending-connection cap - per-IP pending-connection cap - total open media-stream connection cap - safer upgrade-path parsing in the webhook server ### Fix Commit(s) - `1d8968c8a821ff1a05c294a1846b3bcb6f343794` ### Release Process Note `patched_versions` is pre-set to `2026.2.22` so this advisory is ready to publish once npm `[email protected]` and `@openclaw/[email protected]` are released. OpenClaw thanks @jiseoung for reporting.
Quoted source text, attributed separately from HOL analysis.