CVE-2026-119119 Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

High 8.7 Published 29 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119119?

CVE-2026-119119 is a high-severity vulnerability in unclecode crawl4ai, published on 29 Oct 2026.

Official description

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.

Weakness: CWE-770

Which versions are affected by CVE-2026-119119?

How do I fix CVE-2026-119119?

No fix has been published for CVE-2026-119119 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119119 being exploited?

There is no known exploitation of CVE-2026-119119 in the wild and no public exploit code.

Sources

Also known as GHSA-rhjm-7hj7-75fx, GHSA-wh3g-v33g-c47f.