CVE Feed

    Dashboard / CVE / CVE-2026-115508

    CVE-2026-115508

    Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.

    Published:Oct 22, 2026
    Last Modified:Oct 29, 2026
    EPS:Oct 22, 2026
    EPSS Score:0.00305
    CVSS Score:6.5

    Affected Products

    Vendor
    Unclecode
    Product
    Crawl4ai

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-492 Regular Expression Exponential Blowup

    Related CVEs

    CVE-2026-119122 (CVSS 6.9) — Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that all…
    CVE-2026-119121 (CVSS 5.3) — Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that a…
    CVE-2026-119120 (CVSS 7.7) — Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API r…
    CVE-2026-119119 (CVSS 8.7) — Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrust…
    CVE-2026-119118 (CVSS 8.3) — Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers …
    CVE-2026-112363 (CVSS 6.9) — Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API serve…
    CVE-2026-109239 (CVSS 6.9) — Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch tha…
    CVE-2026-109238 (CVSS 9.2) — Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to re…
    CVE-2026-109237 (CVSS 8.6) — Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to…
    CVE-2026-91944 (CVSS 5.1) — crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI whe…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High