CVE-2026-110595
CVE-2026-110595 · BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
This page contains facts from public vulnerability sources. Check the original advisory before updating.
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints to exhaust worker memory and trigger out-of-memory termination.
CVSS 5.3 · Medium · EPSS 0.5%
- Published
- Updated
Affected products and versions
bottlecrm
- Versions
- ≥ 0.45, ≤ 1.14.5: Affected (custom)
No fix published
Original sources
- https://github.com/Django-CRM/Django-CRM/issues/828
- https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/contacts/import_views.py#L44
- https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/cases/import_views.py#L44
- https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110595
- https://www.vulncheck.com/advisories/bottlecrm-0.45-through-1.14.5-memory-exhaustion-via-contact-and-case-csv-import
- https://nvd.nist.gov/vuln/detail/CVE-2026-110595