Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110594BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex

Medium 4.9

In plain English

A medium-severity regular-expression denial of service in BottleCRM from MicroPyramid. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.6%top 48.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by _match_condition() during case saves, exhausting workers shared across all tenants.

Affected products (as reported)

Vendor	Product	Versions
MicroPyramid	BottleCRM	0.43 – through 1.14.5

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/Django-CRM/Django-CRM/issues/830 issue-tracking
https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/cases/routing.py#L107-L114 technical-description
Researcher Disclosure technical-description, exploit
VulnCheck Advisory: BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex third-party-advisory