CVE-2026-110594 in BottleCRM
Summary
by MITRE • 10/14/2026
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by _match_condition() during case saves, exhausting workers shared across all tenants.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
BottleCRM versions 0.43 through 1.14.5 are susceptible to a regular expression denial of service vulnerability that stems from the improper validation and handling of user-supplied input within routing rule configurations. This specific flaw allows authenticated organization administrators, who possess elevated privileges within the application's permission model, to inject maliciously crafted data into system processes. The core technical issue lies in the use of unbounded or poorly constructed regular expression patterns during the evaluation of routing rules. When an administrator attempts to save a case that includes these malformed routing definitions, the underlying Python regex engine is invoked via the _match_condition() function without adequate safeguards against catastrophic backtracking. This mechanism fails to limit the complexity or length of the input strings processed by the regular expression matcher, creating a direct pathway for resource exhaustion attacks.
The operational impact of this vulnerability is severe due to its potential to cause a complete denial of service for all tenants sharing the same application instance. Because BottleCRM operates as a multi-tenant platform, web workers are shared resources across different organizations rather than being isolated per tenant. An attacker who exploits this flaw can trigger an infinite or excessively long loop within the regex engine by providing input that causes catastrophic backtracking. This behavior consumes nearly all available CPU cycles and memory associated with the affected worker processes. Consequently, legitimate users from other tenants experience significant latency or complete inability to access the application, effectively rendering the entire service unavailable until the compromised workers are restarted or the malicious request is terminated at a lower infrastructure level.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. More specifically, it falls under CWE-1325, where regular expressions allow for catastrophic backtracking due to ambiguous or nested quantifiers that cause exponential time complexity relative to input length. In the context of the MITRE ATT&CK framework, this attack vector corresponds to T1496, Resource Hijacking, as the attacker leverages legitimate administrative functions to consume computational resources in a manner intended to disrupt service availability for other users. The vulnerability highlights critical risks associated with allowing high-privilege users to define complex logic patterns without sufficient sanitization or complexity limits enforced by the framework itself.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Organizations running affected versions of BottleCRM should immediately upgrade to a patched version where this issue has been resolved, ensuring that input validation for routing rules is strictly enforced. For environments where upgrading is not immediately feasible, implementing web application firewalls or reverse proxy configurations can help detect and block requests containing patterns indicative of regex backtracking attacks based on known signatures or behavioral anomalies such as unusually long processing times for specific endpoints. Additionally, developers should review the _match_condition() implementation to ensure that all regular expressions used in routing logic are anchored properly and avoid nested quantifiers that could lead to exponential time complexity. Enforcing strict input length limits and validating regex syntax before persistence can further reduce the attack surface associated with this class of vulnerabilities.