CVE-2026-119119

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.5

Description The Docker API server contains a flaw where the clamp untrusted() function does not properly limit the delay before return html, mean delay, and max range fields within untrusted CrawlerRunConfig bodies. Unauthenticated attackers can exploit this by sending excessively large values to the '/crawl' and '/crawl/stream' endpoints. This action can hold browser pages or stall the rate limiter, leading to the exhaustion of the page pool and blocking other crawl operations, resulting in a denial of service.

Recommendations Update to version 0.9.5 or later.