OpenClaw ACP missing prompt-size checks in stdio bridge
OpenClaw's ACP bridge lacked prompt-size validation in its local stdio interface, allowing very large inputs to create oversized payloads that could reduce responsiveness and increase model costs. The vulnerability was patched in version 2026.2.18 with a 2 MiB prompt limit and improved size checks.
What happened
The ACP bridge in OpenClaw versions 2026.2.17 and earlier lacked prompt-size checks in the local stdio bridge, allowing very large prompt text blocks to be accepted and assembled into oversized payloads before forwarding to chat.send.
The vulnerability affected local ACP clients such as IDE integrations that send unusually large inputs through the stdio bridge.
Reported impact
Local ACP sessions could become less responsive when very large prompts were submitted.
Oversized text forwarded to the model could result in larger-than-expected model usage and costs.
Index analysis
The vulnerability involved missing input validation (CWE-20) and uncontrolled resource consumption (CWE-400) in the ACP event-mapper and translator components.
The local stdio transport meant no privilege escalation or direct remote attack path existed in the default ACP model.
Governance controls
OpenClaw patched the vulnerability in version 2026.2.18 by enforcing a 2 MiB prompt-text limit before concatenation, accounting for inter-block newline separator bytes during pre-concatenation size checks, and maintaining final outbound message-size validation before chat.send.
The fix also avoided stale active-run session state when oversized prompts were rejected and added regression tests for oversize rejection and active-run cleanup.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.