CVE-2026-110594
CVE-2026-110594 · BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by _match_condition() during case saves, exhausting workers shared across all tenants.
CVSS 6.9 · Media · EPSS 0,6%
- Publicación
- Actualización
Productos y versiones afectados
bottlecrm
- Versiones
- ≥ 0.43, ≤ 1.14.5: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://github.com/Django-CRM/Django-CRM/issues/830
- https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/cases/routing.py#L107-L114
- https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110594
- https://www.vulncheck.com/advisories/bottlecrm-0.43-through-1.14.5-redos-via-case-routing-rule-regex
- https://nvd.nist.gov/vuln/detail/CVE-2026-110594