CVE-2026-110595 MicroPyramid CVE debrief

Who should care

Defenders responsible for systems using BottleCRM versions 0.45 through 1.14.5, particularly those with mass-import permissions, should assess exposure and potential impact. They should prioritize verifying exposure, assessing potential impact, and implementing compensating controls to limit CSV import size. Additionally, they should review vendor guidance for patching or mitigating the vulnerability and conduct an inventory of assets that use affected Bot

Why it matters

CVE-2026-110595 is a medium-severity vulnerability in BottleCRM that can cause denial of service through uncontrolled memory allocation. Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems with mass-import permissions.

• Denial of service through out-of-memory termination
• Potential for service disruption due to concurrent large CSV imports
• Need for verification of exposure and assessment of potential impact
• Priority for implementing compensating controls to limit CSV import size

Technical summary

The vulnerability is caused by uncontrolled memory allocation in the _read_upload() function, which reads entire CSV uploads before enforcing the 5 MB limit. This allows attackers to exhaust worker memory by sending oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints. The vulnerability affects BottleCRM versions 0.45 through 1.14.5 and can be exploited by authenticated users with mass-import permission. Defenders should focus on verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems with mass-import permissions.

Recommended defensive actions

• Verify exposure by checking systems with mass-import permissions
• Assess potential impact on systems with large CSV import capabilities
• Implement compensating controls to limit CSV import size
• Monitor for suspicious activity on /api/contacts/import/ and /api/cases/import/ endpoints
• Review vendor guidance for patching or mitigating the vulnerability
• Conduct an inventory of assets that use BottleCRM versions 0.45 through 1.14.5
• Track changes to BottleCRM and retest remediated assets

Evidence notes

The vulnerability is caused by uncontrolled memory allocation in the _read_upload() function, which reads entire CSV uploads before enforcing the 5 MB limit. This allows attackers to exhaust worker memory by sending oversized CSV files concurrently.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.