CVE-2026-119119— Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

Quick assessment

Affected

unclecode crawl4ai

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Crawl4AI 在 0.9.5 版本之前存在一个拒绝服务（DoS）漏洞，该漏洞位于其 Docker API 服务器中。问题源于函数未能对不可信的请求体中的、和字段进行上限限制。未认证的攻击者可以向或接口发送极大的数值，从而长时间占用浏览器页面或阻塞速率限制器，最终耗尽页面池资源，导致其他爬取任务无法执行。

CVSS 7.5 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

Source: CVE Program / CVE List V5

Vulnerability Description

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
unclecode	crawl4ai	0 ~ 0.9.5	-

II. Public POCs for CVE-2026-119119

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119119

请登录查看更多情报信息。

Other References for CVE-2026-119119 (2)

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-rhjm-7hj7-75fx vendor-advisory
https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-denial-of-service-via-unbounded-crawlerrunconfig-delay-fields third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119119

Same Patch Batch · unclecode · 2026-10-29 · 5 CVEs total

CVE-2026-119120	7.5 HIGH	Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name
CVE-2026-119118	6.5 MEDIUM	Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
CVE-2026-119122	5.3 MEDIUM	Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
CVE-2026-119121	4.3 MEDIUM	Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

IV. Related Vulnerabilities

Same product: crawl4ai

Same vendor: unclecode

Same weakness: CWE-770