Crawl4AI (< 0.9.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/crawl4ai--0.9.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:33:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCrawl4AI: Denial of service in Docker API server (CVE-2026-119119)https://feed.craftedsignal.io/briefs/2026-10-crawl4ai-dos/Thu, 29 Oct 2026 17:33:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-crawl4ai-dos/Crawl4AI versions prior to 0.9.5 are vulnerable to a denial-of-service attack due to improper validation of delay parameters in untrusted CrawlerRunConfig requests, allowing unauthenticated attackers to exhaust browser page resources.Crawl4AI versions before 0.9.5 contain a denial of service vulnerability in the Docker API server component. The function _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields within untrusted CrawlerRunConfig request bodies. By submitting specially crafted HTTP requests to the /crawl or /crawl/stream endpoints, an unauthenticated attacker can supply excessively large values for these parameters. This forces the application to hold browser pages or stall the rate limiter indefinitely, leading to resource exhaustion of the browser page pool and preventing legitimate crawling operations.

Impact

Successful exploitation allows an unauthenticated attacker to render the Crawl4AI service unavailable for legitimate users by exhausting the browser page pool.

Recommendation

  • Upgrade Crawl4AI to version 0.9.5 or later to resolve the improper input validation in the Docker API server.
  • Implement request rate limiting and input validation at the edge (e.g., WAF or API Gateway) for the /crawl and /crawl/stream endpoints if an immediate upgrade is not possible.
  • Monitor logs for HTTP POST requests to /crawl or /crawl/stream containing unusually large values in the specified JSON fields.
]]>highadvisorydenial-of-serviceinput-validationweb-api