Regular expressions are programming inputs when a service lets clients choose them. The Crawl4AI advisory identified custom extraction and chunking paths where a compact, adversarial pattern triggered catastrophic backtracking. Python regex execution could monopolize a worker under the global interpreter lock, leaving normal endpoint timeout handling unable…
Inspect the ClaimsCase · DiggingBeagle record
Crawl4AI untrusted regular expressions could block the Python service
Attacker-supplied regular expressions in Crawl4AI extraction could consume the Python worker even after request-level timeouts elapsed.
Scope
Affected Crawl4AI Docker <=0.9.4 with untrusted custom extraction, chunking or schema regex controls. Service unresponsiveness reproduced; no code execution or confidential-data extraction shown. Fixed in 0.9.5.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Impact
- Band 1 of 4
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
GHSA-j843-8p47-rhxp documents catastrophic backtracking in untrusted extraction expressions and that ordinary page timeout does not interrupt that Python work. 0.9.5 restricts the vulnerable untrusted regex choices. Wider production impact remains unquantified.
Impact basis: Crafted regex patterns could tie up the Python interpreter and disable service responsiveness. No arbitrary code execution or data theft was demonstrated.
Assessed Oct 19, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CRAWL4AI-REGEX-THREAD-DOS · GHSA-j843-8p47-rhxp: Crawl4AI untrusted regular expressions could block the Python service
At a glance
A top-level crawler timeout does not necessarily interrupt a blocking pattern evaluator under the Python interpreter lock. The vulnerable computation needs a separate resource bound.
Read the implicationsThe demonstrated effect is service availability loss, not secret disclosure. The vendor restricted untrusted custom regex paths in v0.9.5; other regex-bearing surfaces still require independent audit.
Limits and uncertaintyFull account
Regular expressions are programming inputs when a service lets clients choose them. The Crawl4AI advisory identified custom extraction and chunking paths where a compact, adversarial pattern triggered catastrophic backtracking. Python regex execution could monopolize a worker under the global interpreter lock, leaving normal endpoint timeout handling unable to interrupt the expensive matching operation.
The mechanism differs from a slow website. The service is spending CPU evaluating caller-supplied code-like matching rules locally; page-load timeouts do not constrain that computation. The public tests reported delays rising sharply with only modest increases in crafted input length and showed an unresponsive health endpoint. They did not demonstrate exfiltration or control of another process.
Crawl4AI 0.9.5 rejects the relevant untrusted regex configuration while retaining known built-in strategies. Operators still need to account for every other pattern-bearing field. If regex customization remains necessary, safe syntax and execution isolation must be enforced where matching actually runs rather than assumed from a generic crawl timeout.
Claims & evidence
CLM-CRAWL4AI-REGEX-THREAD-DOSUntrusted extraction and chunking patterns allowed expensive regex matching that could trap the Python service even after the page-level timeout had elapsed.supported
Basis: reported finding
- supportsGHSA-j843-8p47-rhxp: Crawl4AI untrusted regular expressions could block the Python serviceprimary disclosure
Custom regex catastrophic backtracking; fixed v0.9.5
Implications
A top-level crawler timeout does not necessarily interrupt a blocking pattern evaluator under the Python interpreter lock. The vulnerable computation needs a separate resource bound.
Controls and mitigations
- Reject attacker-selected regex or run bounded pattern matching in an isolated process with a nonbypassable wall limit.
Unknowns and contradictions
- The demonstrated effect is service availability loss, not secret disclosure. The vendor restricted untrusted custom regex paths in v0.9.5; other regex-bearing surfaces still require independent audit.
Sources and citation
Material revision history
- Oct 19, 2026 · Published version · first publication · revision 174
- Oct 19, 2026 · Canonical change recorded · material revision · revision 175Public fields changed: assessment_profile