CVE-2026-94094 Details
Description
A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion's "streaming/size-limit" was never shipped - latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve.runtime.ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.
A denial-of-service vulnerability has been identified in OpenClaw versions through 2026.9.5, specifically within the Canvas Host Route component. The issue arises in the 'createCanvasHostHandler' function, where the application reads entire files into memory without an effective size limit. This flaw can be exploited remotely by accessing the Canvas Host route and requesting large files, causing memory and event-loop congestion that disrupts normal service operations.
Users are advised to update to a version of OpenClaw that addresses this vulnerability. The latest version as of this writing is 2026.9.5, but it is recommended to check the official OpenClaw repository for any newer releases. In addition, consider implementing the following measures: Replace 'handle.readFile()' with streaming file responses, enforce a maximum file size limit for Canvas Host responses, add per-client and global concurrency limits for file requests, and introduce timeouts for slow-client writes to abort stalled responses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 20, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lche511/cve/tree/main/OpenClaw_Canvas_Big_GET_DoS_Report | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-94094 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/882009 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/408023 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/408023/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenClaw | 2026.6.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 20, 2026 | New CVE Received | [email protected] |