What is GHSA-35gf-m9jx-8qmx?

GHSA-35gf-m9jx-8qmx is a security advisory published by GitHub Security Advisories with High severity. Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in...

Which CVE IDs does GHSA-35gf-m9jx-8qmx cover?

GHSA-35gf-m9jx-8qmx covers the following CVE IDs: CVE-2026-91941. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-35gf-m9jx-8qmx?

GHSA-35gf-m9jx-8qmx has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-35gf-m9jx-8qmxHighCVSS 7.5

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91941 →

📋 Description

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.

🔗 References (4)

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-v2rm-hvrj-2x9q
https://nvd.nist.gov/vuln/detail/CVE-2026-91941
https://www.vulncheck.com/advisories/crawl4ai-before-0.9.3-denial-of-service-via-pdfcontentscrapingstrategy
https://github.com/advisories/GHSA-35gf-m9jx-8qmx