{"id":"CVE-2026-119119","kind":"vulnerability","aliases":["CVE-2026-119119"],"related":[],"title":"Crawl4AI: unbounded delay fields let unauthenticated requests exhaust the crawler","description":"Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.","summary":"Crawl4AI's Docker API server does not cap the delay_before_return_html, mean_delay and max_range fields in crawl requests. An unauthenticated attacker can send very large values to /crawl or /crawl/stream to hold browser pages and stall the rate limiter, blocking other crawls.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crawl4ai","docker","package","self-hosted"],"not_affected_if":["auth-required","internal-only-network","library-only-use"],"how_to_check":"- Check the installed Crawl4AI version with `pip show crawl4ai` or the image tag of the Docker deployment.\n- Confirm whether the Docker API server is reachable from untrusted networks by checking exposed ports on the `/crawl` and `/crawl/stream` endpoints.","fix":"- Crawl4AI versions before `0.9.5` are affected; move to `0.9.5` or later.","status":"open","published_at":"2026-10-29T16:18:04+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:29:21+00:00","updated_at":"2026-10-29T16:29:21+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:29:21Z","model":"claude-haiku-5-5","output":{"fix":"- Crawl4AI versions before `0.9.5` are affected; move to `0.9.5` or later.","reach":"internet","title":"Crawl4AI: unbounded delay fields let unauthenticated requests exhaust the crawler","impact":"medium","summary":"Crawl4AI's Docker API server does not cap the delay_before_return_html, mean_delay and max_range fields in crawl requests. An unauthenticated attacker can send very large values to /crawl or /crawl/stream to hold browser pages and stall the rate limiter, blocking other crawls.","audience":"developers","category":"package","nicknames":[],"who_cares":["crawl4ai","docker","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Crawler page pool exhausted, blocking other crawls and availability","analyst_note":"","how_to_check":"- Check the installed Crawl4AI version with `pip show crawl4ai` or the image tag of the Docker deployment.\n- Confirm whether the Docker API server is reachable from untrusted networks by checking exposed ports on the `/crawl` and `/crawl/stream` endpoints.","plain_action":"","needs_analyst":false,"not_affected_if":["library-only-use","auth-required","internal-only-network"],"who_is_affected":"Teams running the Crawl4AI Docker API server that accept crawl requests from networks they do not fully control. Library-only use without the Docker API server is not described as exposed. Deployments behind authentication or limited to trusted internal callers are less exposed, though the sources do not say whether authentication is enforced by default.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":4186,"output_tokens":596,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119119':13A,16A '-2026':12A,15A '/crawl':54B,111C '/crawl/stream':56B,113C '0.9.5':71C 'api':26B,81C 'attack':47B,105C 'block':66B,128C 'bodi':103C 'browser':59B,116C 'cap':30B,88C 'clamp':84C 'contain':72C 'crawl':43B,68B,130C 'crawl4ai':1A,17B,23B,69C 'crawler':10A 'crawlerrunconfig':102C 'cve':11A,14A 'delay':3A,32B,37B,90C,95C 'denial':74C 'docker':18B,25B,80C 'exhaust':8A,123C 'fail':86C 'field':4A,41B,99C 'hold':58B,115C 'host':22B 'html':35B,93C 'huge':108C 'larg':51B 'let':5A 'limit':65B,122C 'max':39B,97C 'mean':36B,94C 'packag':19B 'page':60B,117C,125C 'pool':126C 'rang':40B,98C 'rate':64B,121C 'request':7A,44B 'return':34B,92C 'self':21B 'self-host':20B 'send':49B,107C 'server':27B,82C 'servic':76C 'stall':62B,119C 'unauthent':6A,46B,104C 'unbound':2A 'untrust':85C,101C 'valu':52B,109C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Crawl4AI Docker API server that accept crawl requests from networks they do not fully control. Library-only use without the Docker API server is not described as exposed. Deployments behind authentication or limited to trusted internal callers are less exposed, though the sources do not say whether authentication is enforced by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119119","severity":null,"published_at":"2026-10-29T16:18:04+00:00","modified_at":"2026-10-29T16:18:04+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}