CVE-2026-91941

Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Published Sep 15, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.

Analysis

Technical impact

Crawl4AI before version 0.9.3 contains an uncontrolled resource consumption flaw in its PDFContentScrapingStrategy. Untrusted clients can trigger the download of arbitrarily large remote PDFs without limits on PDF size or number of pages, a malicious request can deplete disk space, consume excessive CPU cycles, and exhaust network bandwidth on shared workers, resulting in a denial of service. The weakness is an example of CWE-400.

Affected Systems

The affected product is Crawl4AI by unclecode. All releases prior to 0.9.3 are vulnerable. No specific sub‑versions are listed, so any installation of Crawl4AI before as at risk.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1% indicates a very low exploitation probability, and the issue is not currently listed in the CISA KEV catalog. Attack vectors are inferred to be remote, via HTTP POST requests to the PDF scraping endpoint. An attacker only requires the ability to send crafted requests to the service; no authentication is implied in the description. The exploit would lead to service disruption on affected hosts or shared worker environments that host Crawl4AI.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

unclecode

crawl4ai

unaffected

Version	Status	Constraints
`0`	affected	< 0.9.3
`0.9.3`	unaffected	—

No data.

Vendor Product Versions

Unclecode

Crawl4ai

Version	Status	Scheme	Platform
`[0,0.9.3)`	affected	semver	—
`0.9.3`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Crawl4AI to version 0.9.3 or later, which removes the uncontrolled resource consumption bug.
If upgrading is not immediately possible, configure the PDF scraping strategy to enforce hard limits on PDF size and page count to prevent unbounded resource use.
Restrict access to the PDF scraping endpoint by implementing network or application‑level access controls, and apply rate limiting to mitigate abuse.
Monitor disk, CPU, and bandwidth usage on workers running Crawl4AI and alert on abnormal spikes that may indicate exploitation.

Generated by OpenCVE AI on September 20, 2026 at 16:36 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.488% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-v2rm-hvrj-2x9q
https://www.vulncheck.com/advisories/crawl4ai-before-0.9.3-denial-of-service-via-pdfcontentscrapingstrategy

History

Sep 20, 2026 1:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 15, 2026 5:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Unclecode Unclecode crawl4ai
Vendors & Products		Unclecode Unclecode crawl4ai

Sep 15, 2026 3:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.
Title		Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy
Weaknesses		CWE-400
References		https://github.com/unclecode/crawl4ai/security/advisories/GHSA-v2rm-hvrj-2x9q https://www.vulncheck.com/advisories/crawl4ai-before-0.9.3-denial-of-service-via-pdfcontentscrapingstrategy
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`