What is GHSA-qcc3-jqwp-5vh2?

GHSA-qcc3-jqwp-5vh2 is a security advisory published by GitHub Security Advisories with Medium severity. OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Which CVE IDs does GHSA-qcc3-jqwp-5vh2 cover?

GHSA-qcc3-jqwp-5vh2 covers the following CVE IDs: CVE-2026-41343. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qcc3-jqwp-5vh2?

GHSA-qcc3-jqwp-5vh2 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-qcc3-jqwp-5vh2?

GHSA-qcc3-jqwp-5vh2 affects 1 product, including: npm/openclaw:\u003c= 2026.3.28.

GHSA-qcc3-jqwp-5vh2MediumCVSS 5.3

OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Vendor

GitHub Security Advisories

Published

April 2, 2026

Last Modified

May 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-41343 →

📋 Description

Summary

LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Current Maintainer Triage

Status: open
Normalized severity: low
Assessment: Shipped v2026.3.28 lacks a shared pre-auth concurrency budget on the public LINE webhook path, but the effect is bounded transient availability loss only, so low fits.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

57c47d8c7fbf5a2e70cc4dec2380977968903cad — 2026-03-31T19:34:25+09:00

OpenClaw thanks @nexrin for reporting.

🎯 Affected products1

npm/openclaw:<= 2026.3.28