// CanvasMEDIUM
CVE-2026-94094 is a denial-of-service vulnerability in OpenClaw's Canvas Host Route component affecting versions up to 2026.9.5. The flaw in the createCanvasHostHandler function allows remote attackers to trigger DoS by sending large file requests that are buffered entirely in memory instead of streamed. A public exploit has been released and the vendor was notified early.
- CVE-2026-94094 OpenClaw Canvas Host Route server.ts createCanvas(opens in a new tab)
- CVE-2026-94094: Denial of Service in OpenClaw - Live Threat Inte(opens in a new tab)
- CVE-2026-94094 - Medium Vulnerability - TheHackerWire(opens in a new tab)
// Get alerts for Canvas