Crawl4AI CVE-2026-119119

The target must be a Crawl4AI Docker API server (version <= 0.9.4) reachable over the network, with the untrusted /crawl or /crawl/stream endpoints accepting CrawlerRunConfig bodies; the default setup is affected because JWT auth (security.jwt_enabled) is off by default, so any client that can reach the server can submit the request. The specific trigger is sending oversized delay_before_return_html, mean_delay, or max_range values, which _clamp_untrusted() leaves uncapped even though it caps page_timeout and other time fields. Exploitation via /crawl/stream is more severe because it has no wall-clock deadline, whereas /crawl is bounded by limits.wall_clock_s (300s default). Limiting factors: enabling JWT auth and/or keeping the API off untrusted networks prevents it, and upgrading to 0.9.5 (which clamps the three fields to 60s) fully remediates; note the published PoC additionally supplies a bearer token.

The CVSS 4.0 score of 8.7 is driven entirely by availability impact (VA:H) with the vector AV:N/AC:L/AT:N/PR:N/UI:N and no confidentiality or integrity impact - consistent with the CWE-770 resource-exhaustion denial of service described. Exploitation is attractive from an ease standpoint: network-reachable, low attack complexity, no user interaction, and per the vendor advisory JWT auth is off by default, so in a default deployment no authentication is required. The vuln.today decision label is 'this_week', reported by VulnCheck. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active exploitation or a quantified exploitation probability; this is not a confirmed in-the-wild threat. A concrete proof-of-concept (curl requests and a library-level check) is published in the GHSA advisory. CONFLICT TO NOTE: the CVSS vector asserts PR:N (unauthenticated) and the advisory states JWT is disabled by default, yet the PoC itself sends an 'Authorization: Bearer $TOKEN' header - verify whether your deployment requires an API token independently of JWT. Net assessment: a real, easy-to-trigger availability issue worth near-term patching, but the blast radius is bounded to denial of service (no data exposure or code execution) and the affected product's production footprint is limited, so it is a this-week priority rather than an emergency.

An attacker who can reach a default-configured Crawl4AI Docker API server sends a POST to /crawl or /crawl/stream containing a CrawlerRunConfig body with an enormous delay_before_return_html (e.g. 1000000000), mean_delay, or max_range value. The server accepts these unclamped fields and holds browser pages open or stalls the rate limiter for the duration, and a handful of such requests exhaust the page pool so other users' crawls stall or fail. A working proof-of-concept is published in the GHSA advisory; because /crawl/stream has no wall-clock deadline (unlike /crawl, which is bounded to 300s by default), the stream endpoint can tie up pages indefinitely.