CVE-2026-110595

Name of the Vulnerable Software and Affected Versions BottleCRM versions 0.45 through 1.14.5

Description An uncontrolled memory allocation issue exists in the read upload() function. The system reads entire CSV uploads before enforcing the 5 MB size limit. Authenticated users with mass-import permissions can exploit this by sending oversized CSV files concurrently to the '/api/contacts/import/' and '/api/cases/import/' endpoints, which can exhaust worker memory and lead to out-of-memory termination.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.