Login Request a demo
Medium severity · published Oct 22, 2026
CVE-2026-115508
Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields
New
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
crawl4ai · unclecode
0.7.0 before 0.9.5 · source: vendor
Affected product
CR
crawl4ai
unclecode
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115508
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115508
github.com
https://github.com/unclecode/crawl4ai
github.com
https://github.com/unclecode/crawl4ai/commit/8aea2006e2cdb96a185e50b20633fc323dff6429
github.com
https://github.com/unclecode/crawl4ai/releases/tag/v0.9.5
github.com
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j843-8p47-rhxp
www.vulncheck.com
https://www.vulncheck.com/advisories/crawl4ai-0.7.0-before-0.9.5-redos-via-crawl-regex-fields
More from crawl4ai
10.0
CVE-2026-57572
Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
10.0
CVE-2026-53753
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
10.0
CVE-2026-26216
Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
9.6
CVE-2026-57571
Crawl4AI arbitrary file write via download filename path traversal
8.6
CVE-2026-109238
Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder