Crawl4AI's Docker API server contains an inefficient regular expression parser that allows authenticated API clients to supply unbounded regex patterns in the /crawl endpoint. The vulnerability, identified as CWE‑1333, can trigger catastrophic backtracking, causing the server to freeze and rendering service endpoints such as /health unavailable. Attackers gain no direct code execution or data exfiltration, but they can exhaust server resources and disrupt service availability.

The issue affects the Crawl4AI project published under the unclecode organization. Versions 0.7.0 up to, but not including, 0.9.5 are vulnerable. Any deployment that uses these versions and exposes the API endpoint with authenticated access is at risk. The patch is released in v0.9.5, which removes the unbounded regex handling.

The CVSS score of 7.1 indicates a high impact vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to first authenticate to the API, so an active user account with permission to call /crawl is necessary. Once authenticated, an attacker can craft well‑formed regex expressions that cause catastrophic backtracking, forcing the server to terminate event loops. Because the disruption is local to the target deployment, the attack vector is limited to authenticated users, reducing the likelihood of widespread exploitation.