CVE-2026-115508: crawl4ai 0.7.0 to before 0.9.5

Affected technology

crawl4ai · 0.7.0 to before 0.9.5
unclecode

Description’s affected range: before 0.9.5

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality and integrity impact as none; availability impact as high.