CVE-2026-110594 MicroPyramid CVE debrief

Who should care

Defenders responsible for BottleCRM installations, particularly those with authenticated organization administrators, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review routing rule configurations and assess worker exhaustion risks.

Why it matters

Authenticated organization administrators using BottleCRM versions 0.43 through 1.14.5 should assess exposure to a regular expression denial of service vulnerability. The vulnerability allows administrators to block web workers via unbounded routing rule regex patterns. To verify exposure and prioritize remediation, defenders should review routing rule configurations and assess worker exhaustion risks.

• Worker exhaustion can lead to denial of service
• Requires verification of affected versions and configurations
• Remediation priority for exposed versions

Technical summary

The vulnerability is caused by unbounded routing rule regex patterns in BottleCRM versions 0.43 through 1.14.5. Authenticated organization administrators can create routing rules with catastrophically backtracking patterns, which can exhaust web workers shared across all tenants. This can lead to denial of service. To verify exposure and prioritize remediation, defenders should review routing rule configurations and assess worker exhaustion risks. The vulnerability requires authentication and has a medium CVSS score.

Defensive priority

Medium priority for defenders to review and remediate, as the vulnerability requires authentication and has a medium CVSS score.

Recommended defensive actions

• Review routing rule configurations for unbounded regex patterns
• Assess worker exhaustion risks
• Remediate vulnerable versions of BottleCRM
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The source item provides additional details on the vulnerability, including references to the affected code and issue tracker. To verify exposure and prioritize remediation, defenders should review routing rule configurations and assess worker exhaustion risks. Evidence is limited, and defenders should verify affected versions and configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.