CVE-2026-119119

    Dashboard / Vulnerabilities / CVE-2026-119119

    CVE-2026-119119

    Published: 29 Oct 2026Last Modified: 5 Nov 2026

    Summary: Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

    Details: Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119119.json, https://github.com/unclecode/crawl4ai/security/advisories/GHSA-rhjm-7hj7-75fx, https://nvd.nist.gov/vuln/detail/CVE-2026-119119, https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-denial-of-service-via-unbounded-crawlerrunconfig-delay-fields

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -838869bdda93f25e6d50b3f50ae9577d9b19a586

    Affected versions

    v0.9.2
    v0.9.3
    v0.9.1
    v0.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119119 | CVE-DB