Moyenne
7.1
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability...
CVE-2026-115508
Première détection SecPulse
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| unclecode | crawl4ai |
≥ 0.7.0, < 0.9.5 |
0.9.5 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
Références
- web github.com
- web github.com
- web github.com
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com