CVE-2026-110595

Deferred Deferred - Pending Action

Uncontrolled Memory Allocation in BottleCRM

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints to exhaust worker memory and trigger out-of-memory termination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110595

EUVD

EUVD-2026-101223

Affected Vendors & Products

Vendor	Product	Version / Range
MicroPyramid	BottleCRM	0.45

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

BottleCRM versions 0.45 through 1.14.5 have an uncontrolled memory allocation vulnerability in the _read_upload() function. When processing CSV uploads for contacts or cases, the system reads the entire file into memory before enforcing the 5 MB size limit. Authenticated users with mass-import permissions can exploit this by sending oversized files to /api/contacts/import/ or /api/cases/import/ endpoints, causing memory exhaustion and potential out-of-memory termination.

Detection Guidance

Monitor for unusually high memory usage during CSV import operations, especially when large files are uploaded to /api/contacts/import/ or /api/cases/import/. Check server logs for repeated failed import attempts or out-of-memory errors.

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) conditions where the server's memory is exhausted by repeated oversized file uploads. It may cause worker processes to crash, leading to service disruptions. Systems with limited memory resources are particularly vulnerable to performance degradation or crashes.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service conditions through memory exhaustion. GDPR requires data protection measures to ensure availability, while HIPAA mandates safeguards against disruptions. Exploits could lead to service unavailability, potentially violating these requirements.

Mitigation Strategies

Upgrade to a patched version of BottleCRM where the _read_upload() function enforces size limits during file reading. Alternatively, implement network-level restrictions to block oversized uploads to the vulnerable endpoints.

Hi! I’m here to help you understand CVE-2026-110595. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70