CVE-2026-110594: Micropyramid Bottlecrm

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by _match_condition() during case saves, exhausting workers shared across all tenants.

Affected products

• Micropyramid Bottlecrm: from 0.43, up to and including 1.14.5

Published 2026-10-14. Last modified 2026-10-16.