{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/crawl4ai-0.9.0--version--0.9.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:crawl4ai:crawl4ai:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-119119"},{"cvss":7.5,"id":"CVE-2026-119120"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Crawl4AI (\u003c 0.9.5)","Crawl4AI (0.9.0 \u003c= version \u003c 0.9.5)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","input-validation","web-api"],"_cs_type":"advisory","_cs_vendors":["Crawl4AI"],"content_html":"\u003cp\u003eCrawl4AI versions before 0.9.5 contain a denial of service vulnerability in the Docker API server component. The function \u003ccode\u003e_clamp_untrusted()\u003c/code\u003e fails to cap the \u003ccode\u003edelay_before_return_html\u003c/code\u003e, \u003ccode\u003emean_delay\u003c/code\u003e, and \u003ccode\u003emax_range\u003c/code\u003e fields within untrusted \u003ccode\u003eCrawlerRunConfig\u003c/code\u003e request bodies. By submitting specially crafted HTTP requests to the \u003ccode\u003e/crawl\u003c/code\u003e or \u003ccode\u003e/crawl/stream\u003c/code\u003e endpoints, an unauthenticated attacker can supply excessively large values for these parameters. This forces the application to hold browser pages or stall the rate limiter indefinitely, leading to resource exhaustion of the browser page pool and preventing legitimate crawling operations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to render the Crawl4AI service unavailable for legitimate users by exhausting the browser page pool.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Crawl4AI to version 0.9.5 or later to resolve the improper input validation in the Docker API server.\u003c/li\u003e\n\u003cli\u003eImplement request rate limiting and input validation at the edge (e.g., WAF or API Gateway) for the \u003ccode\u003e/crawl\u003c/code\u003e and \u003ccode\u003e/crawl/stream\u003c/code\u003e endpoints if an immediate upgrade is not possible.\u003c/li\u003e\n\u003cli\u003eMonitor logs for HTTP POST requests to \u003ccode\u003e/crawl\u003c/code\u003e or \u003ccode\u003e/crawl/stream\u003c/code\u003e containing unusually large values in the specified JSON fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T18:42:50Z","date_published":"2026-10-29T17:33:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-crawl4ai-dos/","summary":"Crawl4AI versions prior to 0.9.5 are vulnerable to a denial-of-service attack due to improper validation of delay parameters in untrusted CrawlerRunConfig requests, allowing unauthenticated attackers to exhaust browser page resources.","title":"Crawl4AI: Denial of service in Docker API server (CVE-2026-119119)","url":"https://feed.craftedsignal.io/briefs/2026-10-crawl4ai-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Crawl4AI (0.9.0 \u003c= Version \u003c 0.9.5)","version":"https://jsonfeed.org/version/1.1"}