CVE-2026-110594: BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by matchcondition() during case saves, exhausting workers shared across all tenants.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated organization administrator can exploit it by creating a case routing rule containing a catastrophically backtracking regular expression.
What action triggers the denial of service?
The problematic routing-rule expression is evaluated by _match_condition() when cases are saved. A crafted pattern can block web workers, and those workers are shared across tenants.
What is the impact on other tenants?
Exhausting shared web workers can affect all tenants using those workers, not only the attacker's organization.
What can be done if updating is not immediately possible?
The provided information identifies creation of routing rules with unbounded regular-expression patterns as the exploit path. Restricting organization administrators' ability to create or modify such rules can reduce exposure.