CVE-2026-115508 Details
Description
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
A denial-of-service vulnerability has been identified in Crawl4AI versions 0.7.0 prior to 0.9.5. This issue arises from an inefficient regular expression handling in the Docker API server, allowing authenticated API clients to submit unbounded regular expressions in the /crawl request bodies. Attackers can exploit this by sending catastrophic-backtracking patterns through various fields, including RegexExtractionStrategy.custom, RegexChunking.patterns, and certain schema regex fields, against a crafted page. This exploitation can freeze the entire server, causing it to become unresponsive to all requests, including health checks.
Users can update to Crawl4AI version 0.9.5, where this vulnerability has been patched. Instructions for updating are available in the release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j843-8p47-rhxp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/unclecode/crawl4ai | [email protected] | Vendor |
| https://github.com/unclecode/crawl4ai/commit/8aea2006e2cdb96a185e50b20633fc323dff6429 | [email protected] | Source CodeVendor |
| https://github.com/unclecode/crawl4ai/releases/tag/v0.9.5 | [email protected] | Release NotesVendor |
| https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j843-8p47-rhxp | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/crawl4ai-0.7.0-before-0.9.5-redos-via-crawl-regex-fields | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Crawl4AI | >= 0.7.0, < 0.9.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |