Medium 7.1

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability...

CVE-2026-115508 First seen on SecPulse 04:14

Affected packages

Ecosystem	Package	Affected	Fixed
unclecode	crawl4ai	≥ 0.7.0, < 0.9.5	0.9.5

Original description The description as published by the source.

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.5; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4: High 7.1; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Published: Oct 23, 2026
First seen on SecPulse: 04:14
GHSA: GHSA-q4c3-mqc5-j3m8
CWE: CWE-1333

NVD GitHub Advisory

Tags(click for explanation)

All

Cwe 1333 Unclecode Crawl4Ai

Detection sources

NIST National Vulnerability Database05:17
GitHub Security Advisories (Global)06:32
CVE.org (CVE Program・cvelistV5)04:14