CVE-2026-110595
CVE-2026-110595 · BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints to exhaust worker memory and trigger out-of-memory termination.
CVSS 5.3 · Mittel · EPSS 0,5%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
bottlecrm
- Softwareversionen
- ≥ 0.45, ≤ 1.14.5: Betroffen (custom)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/Django-CRM/Django-CRM/issues/828
- https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/contacts/import_views.py#L44
- https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/cases/import_views.py#L44
- https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110595
- https://www.vulncheck.com/advisories/bottlecrm-0.45-through-1.14.5-memory-exhaustion-via-contact-and-case-csv-import
- https://nvd.nist.gov/vuln/detail/CVE-2026-110595