7.5
HighCVSS 3.1 · from VulnCheck
CVE-2026-119119
Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields
crawl4ai · Allocation without limits · CWE-770Affectedcrawl4ai
FixUpdate to 0.9.5 or newer
PublishedOct 29, 15:58 · VulnCheck
ScoredOct 29 · 7.5 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can take the service down. CVSS impact.
Description
Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed incrawl4aibefore 0.9.50.9.5crawl4aiNot affected0.9.5
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known