Skip to content
Heist/ feed
High

Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields

Type: advisorySource: Official CVE List1 source record

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.

Announced Source revision 1
Original source ↗

CVE-2026-115508

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-115508

crawl4ai

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "unclecode",
    "product": "crawl4ai",
    "versions": [
      {
        "status": "affected",
        "version": "0.7.0",
        "lessThan": "0.9.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "0.9.5",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:pypi/crawl4ai",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-115508

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#52375 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement