Live › vulnerability › CVE-2026-115508
Go to dashboardCrawl4AI's Docker API server accepts unbounded regular expressions in /crawl request bodies, and a crafted pattern causes catastrophic backtracking. An authenticated API client can freeze the entire server, including the /health endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run the Crawl4AI Docker API server at version up to and let authenticated clients submit /crawl requests with regex extraction or chunking fields are exposed. Teams that use Crawl4AI only as a Python library, or that never expose the Docker API server, can skip it.
0.7.00.9.5No product ranges from the sources yet.
pip show crawl4ai or the image tag of the Docker deployment; affected versions are 0.7.0 up to but not including 0.9.5./crawl requests from clients outside the trusted team.0.9.5 or later, including the Docker image./crawl endpoint and limit API client credentials.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
This page as .md · .json · in your agent: get_signal("CVE-2026-115508")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.