Crawl4AI: Denial of Service via unbounded crawler delay fields
Summary
The Docker API server of Crawl4AI does not cap the delay_before_return_html, mean_delay and max_range fields of untrusted crawl requests. A network client that can reach the API can send very large values to /crawl or /crawl/stream, which keeps browser pages busy and stalls the rate limiter. This exhausts the page pool and blocks other crawls, which is a service outage risk without data loss. The default configuration is affected because JWT authentication is disabled by default.
Affected
- Crawl4AI versions before 0.9.5 (the GitHub advisory lists <= 0.9.4)
- Docker API server in default settings, where JWT authentication is off
Fixed in
- Upgrade to Crawl4AI 0.9.5 (released 2026-10-14), which caps the delay fields at 60 seconds for untrusted requests
- The vendor does not backport fixes to earlier release lines, so 0.8.x and 0.9.x users must upgrade
Workaround
- No vendor workaround is documented; the fix is a version upgrade.
- Until upgraded: enable JWT authentication (security.jwt_enabled) and keep the API off untrusted networks.
- Restricting access to the Docker API port (internal network only or an authenticated reverse proxy) is general hardening advice, not a vendor recommendation.
Exploitation
- The GitHub advisory includes a proof of concept using curl requests against the Docker server.
- Research found no reports of exploitation in the wild as of 31 Oct 2026.
- CISA KEV status was not verified.
- EPSS score: 0.36 %.
Our recommendation
- Find all Crawl4AI installations (Docker images, PyPI pins) and check for versions below 0.9.5.
- Upgrade to 0.9.5 or later, including all 0.9.x and 0.8.x deployments.
- Confirm the Docker API port is not reachable from the public internet. If it is, treat this as urgent.
- Monitor for unusually long-running crawl requests until the upgrade is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rhjm-7hj7-75fx github.com
- VulnCheck advisory: Crawl4AI before 0.9.5 Denial of Service www.vulncheck.com
- Crawl4AI security overview github.com
- Crawl4AI CHANGELOG github.com
- Mend vulnerability database: CVE-2026-119119 www.mend.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:36.
Original description (NVD)
Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.