CVE-2026-110595
CVE-2026-110595 · BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints to exhaust worker memory and trigger out-of-memory termination.
CVSS 5.3 · Media · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
bottlecrm
- Versiones
- ≥ 0.45, ≤ 1.14.5: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://github.com/Django-CRM/Django-CRM/issues/828
- https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/contacts/import_views.py#L44
- https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/cases/import_views.py#L44
- https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110595
- https://www.vulncheck.com/advisories/bottlecrm-0.45-through-1.14.5-memory-exhaustion-via-contact-and-case-csv-import
- https://nvd.nist.gov/vuln/detail/CVE-2026-110595