GHSA-cxpw-2g23-2vgw: OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs
- Identifiers
- CVE-2026-27576GHSA-cxpw-2g23-2vgw
- Published
- Record updated
- Affected
- openclaw <= 2026.2.17
- Fixed in
- 2026.2.19
- released February 19, 2026, 1 day before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
GHSA-cxpw-2g23-2vgw affects the npm package `openclaw` at versions `<= 2026.2.17`. The ACP bridge accepted very large prompt text blocks and could assemble oversized payloads before forwarding them to `chat.send`, mainly affecting local ACP clients such as IDE integrations over stdio. The source states the impact is reduced responsiveness and higher model usage cost, with no privilege escalation or direct remote attack path in the default ACP model.
Mitigation
Patched in `2026.2.18` (planned next release). The remediation enforces a 2 MiB prompt-text limit before concatenation, counts inter-block newline separator bytes during pre-concatenation size checks, keeps final outbound message-size validation before `chat.send`, avoids stale active-run session state when oversized prompts are rejected, and adds regression tests for oversize rejection and active-run cleanup.
Related items
- LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
- InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
- LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog