CVE-2026-91941: Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy
Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Deployments running Crawl4AI before 0.9.3 are exposed when untrusted clients can submit POST requests that select the PDF scraping strategy. Shared workers are particularly at risk because the downloaded PDFs can exhaust shared disk, CPU, and bandwidth resources.
What does an attacker need to exploit it?
An attacker needs network access to a POST request endpoint that accepts untrusted input and permits selection of PDFContentScrapingStrategy. No privileges or user interaction are required.
How can I tell whether my deployment is affected?
Check whether the Crawl4AI version is earlier than 0.9.3 and whether POST requests from untrusted clients can select the PDF scraping strategy. Such requests may cause workers to download large remote PDFs without size or page limits.