CVE-2026-91941

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91941
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91941.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91941
Aliases
  • GHSA-v2rm-hvrj-2x9q
Published
2026-09-15T15:18:01Z
Modified
2026-09-17T03:47:20Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy
Details

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91941.json"
}
References

Affected packages

Git / github.com/unclecode/crawl4ai

Affected ranges

Type
GIT
Repo
https://github.com/unclecode/crawl4ai
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4bcd5fa8a56000ce103dd499e8ecdff2439f3e9c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.3"
        },
        {
            "introduced": "Crawl4AI"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.3.4
docker-rebuild-v0.*
docker-rebuild-v0.8.6
docker-rebuild-v0.8.7
docker-rebuild-v0.8.8
docker-rebuild-v0.8.9
docker-rebuild-v0.9.0
docker-rebuild-v0.9.1
docker-rebuild-v0.9.2
v.*
v.3.72
v0.*
v0.0.75
v0.1.0
v0.2.0
v0.2.1
v0.2.4
v0.2.6
v0.2.7
v0.2.71
v0.2.72
v0.2.73
v0.2.74
v0.2.77
v0.3.0
v0.3.3
v0.3.6
v0.3.745
v0.4.24
v0.4.243
v0.5.0.post1
v0.6.3
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.2
vr0.*
vr0.6.0
vr0.6.0rc1
vr0.6.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91941.json"