Crawl4AI EUVD-2026-108340

Exploitation requires (1) the Crawl4AI Docker API server deployment mode - the library imported directly is not affected unless the host application itself passes untrusted regexes into these strategies; (2) a valid API bearer token (PR:L / authenticated client); and (3) a crawl target page the attacker can control or influence whose text triggers backtracking (e.g. 'a'*n + 'X'). The specific sinks are RegexExtractionStrategy.custom, RegexChunking.patterns, and schema fields of type 'regex' in JsonCssExtractionStrategy/JsonXPathExtractionStrategy/JsonLxmlExtractionStrategy, which lacked entries in UNTRUSTED_FIELD_ALLOWLIST so _filter_untrusted_fields() let the caller-supplied patterns through. Limiting factors: a token is required (not unauthenticated), only the affected 0.9.x Docker builds are impacted, and the built-in RegexExtractionStrategy patterns remain safe/available - only caller-supplied patterns are the vector.

This is a genuine but bounded availability issue, not a drop-everything emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) correctly frames it: network-reachable, low attack complexity, but requiring low-level privileges (PR:L) - a valid API token - and producing availability-only impact (VA:H), with no confidentiality or integrity effect. The vuln.today Decision label is 'this_week' (not act_now/emergency), which aligns with the picture of an authenticated denial-of-service rather than an unauthenticated RCE. There is no CISA KEV listing and no EPSS score in the input, so there is no signal of active or widespread exploitation - consistent with an authenticated-only bug reported via coordinated disclosure (VulnCheck, researcher Zhixi 'Jace' Sun). A complete, working proof-of-concept is published in the GHSA advisory itself (the curl command plus the (a+)+$ pattern), so the barrier to reproduction is effectively zero for anyone holding a token. The main thing moderating real-world risk is the authentication requirement and the narrow exposure: only the Docker API server deployment mode is affected, and the library used directly is not affected unless an application itself forwards untrusted regexes into these strategies. Net: a real, easily-reproduced DoS that trusted-token-holders or anyone who can obtain/leak a token can trigger, best handled on the vendor's 'this_week' cadence rather than as an active-exploitation fire drill.

An attacker holding a valid Docker API token hosts a page containing a long run of 'a' characters (e.g. 40) ending in 'X', then sends a single /crawl request supplying the catastrophic-backtracking pattern (a+)+$ via RegexExtractionStrategy.custom (or RegexChunking.patterns, or a regex-typed schema field). Python's re engine holds the GIL while the match backtracks exponentially, so the entire server stops answering every request - including /health - for all users, and the crawl deadline cannot interrupt it. A full working PoC is published in the GHSA advisory, so exploitation requires no additional development.