Medium severity4.9NVD Advisory· Published Oct 14, 2026· Updated Oct 14, 2026
CVE-2026-110594
CVE-2026-110594
Description
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by _match_condition() during case saves, exhausting workers shared across all tenants.
Affected products
30.43 - 1.14.5+ 1 more
- (no CPE)range: 0.43 - 1.14.5
- (no CPE)
- Range: 0.43 - 1.14.5
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.