CVE-2026-119119 Details
Description
Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.
A denial-of-service vulnerability has been identified in Crawl4AI versions prior to 0.9.5, specifically within the Docker API server. The issue arises because the function '_clamp_untrusted()' does not properly limit certain fields in untrusted 'CrawlerRunConfig' bodies, allowing unauthenticated attackers to send excessive values that can tie up browser pages or disrupt the rate limiter. This exhausts the server's page pool, blocking other crawls.
Update Crawl4AI to version 0.9.5 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/unclecode/crawl4ai/security/advisories/GHSA-rhjm-7hj7-75fx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/unclecode/crawl4ai/security/advisories/GHSA-rhjm-7hj7-75fx | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-denial-of-service-via-unbounded-crawlerrunconfig-delay-fields | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| unclecode Crawl4AI | <= 0.9.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |