CVE-2026-115508: Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated client of the Crawl4AI Docker API server can exploit it. The attacker must be able to submit a /crawl request body and provide a crafted page that triggers catastrophic backtracking in the supplied regular expression.
Are deployments affected by default?
The issue is in the Docker API server and requires authenticated API access. The available data does not state whether authentication is enabled or how the API is exposed in a default deployment.
What is the operational impact of successful exploitation?
A successful request can freeze the entire server, including its /health endpoint. This creates a denial-of-service condition without requiring user interaction.
Which request fields should be reviewed for exposure?
Review /crawl requests using RegexExtractionStrategy.custom, RegexChunking.patterns, or regex fields in JsonCss, JsonXPath, and JsonLxml schemas. These are the identified paths through which unbounded regular expressions can be supplied.
What mitigation is available?
Upgrade Crawl4AI to version 0.9.5 or later. If upgrading cannot be done immediately, restrict authenticated access to the Docker API server and prevent untrusted clients from supplying regex values in the identified /crawl fields.