CVE-2026-115508

Name of the Vulnerable Software and Affected Versions Crawl4AI versions 0.7.0 through 0.9.4

Description The Docker API server contains an issue where authenticated API clients can provide unbounded regular expressions in the '/crawl' endpoint request bodies. This can lead to catastrophic backtracking—a condition where a regular expression engine takes an exponential amount of time to process a specific input—when using RegexExtractionStrategy.custom, RegexChunking.patterns, or the regex fields within JsonCss, JsonXPath, and JsonLxml schemas against a specially crafted page. This can result in the entire server freezing, including the '/health' endpoint.

Recommendations Update Crawl4AI to version 0.9.5 or later. As a temporary mitigation, restrict the use of RegexExtractionStrategy.custom, RegexChunking.patterns, and regex fields in JsonCss, JsonXPath, and JsonLxml schemas.