CVE-2026-115508
mediumCrawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients…
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/unclecode/crawl4ai disclosure@vulncheck.com
- https://github.com/unclecode/crawl4ai/commit/8aea2006e2cdb96a185e50b20633fc323dff6429 disclosure@vulncheck.com
- https://github.com/unclecode/crawl4ai/releases/tag/v0.9.5 disclosure@vulncheck.com
- https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j843-8p47-rhxp disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/crawl4ai-0.7.0-before-0.9.5-redos-via-crawl-regex-fie... disclosure@vulncheck.com
- https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j843-8p47-rhxp 134c704f-9b21-4f2e-91b3-4a467353bcc0