CVE-2026-110595— BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
Quick assessment
Affected
MicroPyramid BottleCRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MicroPyramid | BottleCRM | 0.45≤ 1.14.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110595
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
Source: CVE Program / CVE List V5
Vulnerability Description
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints to exhaust worker memory and trigger out-of-memory termination.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MicroPyramid | BottleCRM | 0.45 ~ 1.14.5 | - |
|
II. Public POCs for CVE-2026-110595
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110595
请登录查看更多情报信息。
Other References for CVE-2026-110595 (4)
-
Django-CRM/backend/cases/import_views.py at v1.14.5 · Django-CRM/Django-CRM · GitHub technical-description
-
Django-CRM/backend/contacts/import_views.py at v1.14.5 · Django-CRM/Django-CRM · GitHub technical-description
Same Patch Batch · MicroPyramid · 2026-10-14 · 4 CVEs total
| CVE-2026-110593 | 5.4 MEDIUM | BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail |
| CVE-2026-110594 | 4.9 MEDIUM | BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex |
| CVE-2026-110592 | 3.5 LOW | BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template |
IV. Related Vulnerabilities
Same weakness: CWE-770
-
CVE-2026-110843
n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth -
CVE-2026-109527
Model Context Protocol Python SDK HTTP and OAuth endpoints a -
CVE-2026-108395
Model Context Protocol Java SDK HTTP server transports allow -
CVE-2026-102048
Junos OS: An attacker causes l2cpd crash when FNP is used wi -
CVE-2026-101971
Junos OS and Junos OS Evolved: An attacker causes routing pr
V. Comments for CVE-2026-110595
No comments yet