CVE-2026-110594 Details

A regular expression denial-of-service (ReDoS) vulnerability has been identified in BottleCRM versions 0.43 through 1.14.5. This vulnerability allows authenticated organization administrators to disrupt web workers by creating unbounded routing rule regex patterns. The issue arises because the routing rules, once established, are evaluated by the '_match_condition()' function during case saves. This evaluation process can be exploited to exhaust workers that are shared across all tenants, effectively blocking case intake for the entire organization.

It is recommended to implement a maximum length limit for regex patterns used in routing rules and to evaluate these patterns with a timeout to prevent catastrophic backtracking. This can be done by using the 'regex' module, which is a drop-in replacement for Python's built-in 're' module and supports regex evaluation with a timeout.