Database/AI/ML frameworks & serving
Crawl4AI Docker API: unbounded delay fields let an unauthenticated client exhaust the crawler page pool
Impact
_clamp_untrusted() fails to cap delay_before_return_html, mean_delay and max_range in untrusted CrawlerRunConfig bodies. A client posting huge values to /crawl or /crawl/stream holds browser pages open or stalls the rate limiter until the page pool is exhausted, after which every other crawl on that instance blocks. On a shared node this is a tenant-reachable way to park the service's browser workers indefinitely; recovery means restarting the container, and queued jobs are lost.
Who can reach it
Unauthenticated HTTP request to the Crawl4AI Docker API's /crawl or /crawl/stream endpoint. Anyone who can reach the API port.
What to do
Upgrade Crawl4AI to 0.9.5 or later and restart the API container. Interim mitigation is to front the API with an authenticated gateway that rejects or clamps these config fields and to rate-limit callers. Container image replacement and restart; no node reboot.
References
Related entries
- n8n: deprecated code nodes execute JavaScript in the main process, outside task-runner isolationCVE-2026-119408 · n8n (deprecated Function, Function Item and LangChain Code nodes)High
- KubeAI (Ollama engine controller): Injection in `ollamaStartupProbeScript()`CVE-2026-34940 · KubeAI (Ollama engine controller)High
- Flowise: public chatflow endpoints return raw flowData including plaintext API keysCVE-2026-41278 · Flowise (GET /api/v1/public-chatflows/:id and public-chatbotConfig response sanitization)High
- Nocturne Memory: empty API_TOKEN disables auth, exposing the agent knowledge graph to the LANCVE-2026-44830 · Nocturne Memory (BearerTokenAuthMiddleware when API_TOKEN is unset)High
- vLLM: user-supplied structured-output regex compiles with no timeout, hanging an inference workerCVE-2026-55574 · vLLM structured_outputs.regex (xgrammar / outlines grammar compilation)High
- Hugging Face Datasets: pickle-backed pandas builder executes code from a dataset file on loadCVE-2026-57845 · Hugging Face Datasets (deprecated pandas packaged builder, Pandas._generate_tables)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.