CVE-2026-110595 — BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authentic…
Published: 2026-10-14 · CVSS: 5.3 · CVSS 4.0
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints to exhaust worker memory and trigger out-of-memory termination.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7