Skip to content
Crawl4AI Vulnerabilities: DoS and Untrusted Model Loading Issues

Crawl4AI Vulnerabilities: DoS and Untrusted Model Loading Issues

First seen 30 Oct 2026, 02:13 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 03:45 UTC
  • •Crawl4AI versions before 0.9.5 are vulnerable to DoS and untrusted model loading.
  • •Denial of Service can be triggered via unbounded Crawlerrunconfig delay fields.
  • •Untrusted model loading allows arbitrary code execution through manipulated model names.

Crawl4AI versions before 0.9.5 are affected by two vulnerabilities: a Denial of Service (DoS) due to unbounded Crawlerrunconfig delay fields and untrusted model loading via the CosineStrategy model name. The DoS vulnerability (CWE-770) allows attackers to exploit the delay fields, potentially leading to service outages. The untrusted model loading vulnerability (CWE-502) can allow attackers to execute arbitrary code by manipulating model names. Both vulnerabilities affect versions from 0.9.0 to before 0.9.5, with the potential for significant impact on systems using these versions. No has been reported for either vulnerability as of the publication date. Users are advised to upgrade to version 0.9.5 or later to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-30
Crawl4AI vulnerabilities disclosed
Two vulnerabilities affecting Crawl4AI versions before 0.9.5 were disclosed, including a DoS and untrusted model loading issue.
VulnCheck
2026-10-30
Patch released for Crawl4AI
Crawl4AI version 0.9.5 was released to address the identified vulnerabilities, urging users to upgrade.
VulnCheck

More articles in this cluster (2)

Extracted Entities (4)

1 / 3

Common questions

What versions of Crawl4AI are affected?
Crawl4AI versions from 0.9.0 to before 0.9.5 are affected by these vulnerabilities.
Have these vulnerabilities been exploited in the wild?
No active exploitation has been reported for either vulnerability as of the publication date.
What should users do to protect themselves?
Users should upgrade to Crawl4AI version 0.9.5 or later to mitigate these vulnerabilities.