Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

Summary

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.

Remediation

1. Inventory every unclecode crawl4ai deployment, including staging.
2. Upgrade unclecode crawl4ai to 0.9.5.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/unclecode/crawl4ai/security/advisories/GHSA-rhjm-7hj7-75fx
• Advisoryhttps://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-denial-of-service-via-unbounded-crawlerrunconfig-delay-fields