CVE-2026-91941

Crawl4AI versions before 0.9.3 contain an uncontrolled resource consumption flaw (CWE-400) in the PDFContentScrapingStrategy component. An unauthenticated attacker can send a POST request that selects the PDF scraping strategy and points it at an arbitrarily large remote PDF, which the server downloads and processes without any file-size or page-count limits. This exhausts disk space, CPU, and bandwidth on the worker, causing denial of service for shared or multi-tenant Crawl4AI deployments that accept untrusted crawl requests. The issue is rated high severity (CVSS 4.0: 8.7) because it requires no privileges or user interaction and has a full availability impact. No public proof of concept is known, it is not in the CISA KEV catalog, and there is no evidence of in-the-wild exploitation.

What to do: Upgrade Crawl4AI to version 0.9.3 or later, which introduces size and page limits for the PDF scraping strategy. Until patched, restrict API access to authenticated or trusted networks, and disable or block the PDFContentScrapingStrategy for untrusted requests. Consider enforcing proxy-level download size caps and timeouts, and monitor workers for abnormal disk, CPU, or bandwidth consumption as signs of abuse.