CVE-2026-110595: BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in readupload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints to exhaust worker memory and trigger out-of-memory termination.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated BottleCRM user must have mass-import permission. The affected import endpoints are /api/contacts/import/ and /api/cases/import/.
What is required to cause service disruption?
An attacker can submit oversized CSV uploads concurrently. The application reads each upload fully into memory before applying its 5 MB limit, which can exhaust worker memory and cause out-of-memory termination.
Are normal CSV imports affected?
The issue is specifically triggered by oversized CSV uploads that exceed the intended 5 MB limit. The provided information does not indicate an impact from uploads within that limit.
Which versions should be investigated?
BottleCRM versions 0.45 through 1.14.5 are affected. Systems in that range with users granted mass-import permission should be prioritized for review.