CVE-2026-115508

Medium

Description

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.

SeverityMedium

CVSS6.5

Exploit probability—

ProductUnclecode Crawl4ai

PublishedOct 22, 2026

First seenOct 22, 2026

Weakness typeCWE-1333CWE-1333

How to fix

Update

unclecode crawl4ai0.9.5 or later

Patches

github.com/unclecode/crawl4ai/commit/8aea2006e2cdb96a185e50b20633fc323dff6429

Vendor advisories

Affected products

Product	Affected versions	Fixed in
unclecode crawl4ai	0.7.0 ≤ v < 0.9.5	0.9.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.