BottleCRM Regex DoS via Routing Rule Patterns

Executive Summary

CVE-2026-110594 is a Regular Expression Denial-of-Service (ReDoS) vulnerability in BottleCRM affecting versions 0.43 through 1.14.5. Authenticated organization administrators can exploit unbounded regex patterns in routing rules, causing catastrophic backtracking during case saves. This exhausts web workers shared across all tenants, blocking case intake until the malicious rule is manually removed.

Useful 0 Not Useful 0

Detection Guidance

To detect this ReDoS vulnerability in BottleCRM, monitor for unusually high CPU usage during case creation or updates. Check for routing rules with regex patterns exceeding 200 characters or containing complex backtracking constructs like (a+)+. Review logs for hanging worker processes or timeouts during case processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated admin to disrupt case management operations for the entire organization by creating a routing rule with a malicious regex pattern. It blocks web workers, preventing case creation or updates until the rule is removed. The impact includes downtime for case intake and potential loss of service for all tenants.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by disrupting case management operations, potentially leading to unauthorized access or data processing delays. The ReDoS attack blocks worker processes, causing denial of service and affecting availability of sensitive data handling systems.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict admin access to routing rule creation. Implement regex pattern length limits (max 200 characters) and add timeout mechanisms (1 second) for regex evaluation in _match_condition(). Temporarily disable regex matching in routing rules until patches are applied.

Useful 0 Not Useful 0