{"id":"CVE-2026-119119","aliases":[],"cve":{"records":[{"id":"CVE-2026-119119","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T14:25:14.745Z","published":"2026-10-29T15:58:03.704Z","modified":"2026-10-29T15:58:03.704Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-29T15:58:03.704Z"}],"references":[{"url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-rhjm-7hj7-75fx","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-denial-of-service-via-unbounded-crawlerrunconfig-delay-fields","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","source":"VulnCheck"}],"applicability":[],"prioritization":[]},"title":"Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.","score":8.7,"severity":"high","published":"2026-10-29T15:58:03.704Z","modified":"2026-10-29T15:58:03.704Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"unclecode","name":"crawl4ai","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.9.5","versionType":"semver"},{"version":"0.9.5","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/crawl4ai","packageIdentity":{"ecosystem":"PyPI","name":"crawl4ai"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119119"}],"remediation":[],"references":["https://github.com/unclecode/crawl4ai/security/advisories/GHSA-rhjm-7hj7-75fx","https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-denial-of-service-via-unbounded-crawlerrunconfig-delay-fields"],"sources":[{"name":"CVE","id":"CVE-2026-119119","modified":"2026-10-29T15:58:03.704Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119119"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T17:05:40.566Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T02:55:33.139Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Crawl4AI before 0.9.5 has a denial of service vulnerability in the Docker API server, where unauthenticated attackers can send large values to exhaust the page pool and block other crawls. The weakness is due to unbounded delay fields in CrawlerRunConfig. This affects versions less than 0.9.5.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T10:02:11.971Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119119"}]}}