CVE-2026-110595 Details
Description
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints to exhaust worker memory and trigger out-of-memory termination.
A memory exhaustion vulnerability has been identified in BottleCRM versions 0.45 through 1.14.5. The issue arises in the CSV import functionality for contacts and cases, where the application reads entire uploaded files before applying a 5 MB size limit. This flaw allows authenticated users with mass-import permissions to upload oversized CSV files to the '/api/contacts/import/' and '/api/cases/import/' endpoints. The concurrent uploads can exhaust the server's memory resources, leading to out-of-memory errors and process terminations.
The vulnerability can be addressed by modifying the file upload handling to read only a portion of the file that is within the size limit, similar to the implementation in the leads import endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Django-CRM/Django-CRM/issues/828 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110595 | [email protected] | |
| https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/cases/import_views.py#L44 | [email protected] | Source CodeVendor |
| https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/contacts/import_views.py#L44 | [email protected] | Source CodeVendor |
| https://github.com/Django-CRM/Django-CRM/issues/828 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/bottlecrm-0.45-through-1.14.5-memory-exhaustion-via-contact-and-case-csv-import | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BottleCRM | >= 0.45, <= 1.14.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | CVE Modified | [email protected] |
| Oct 14, 2026 | New CVE Received | [email protected] |