BottleCRM versions 0.43 through 1.14.5 contain a regular expression denial of service flaw. An authenticated organization administrator can create a case routing rule that contains an unbounded back‑tracking regex. When the rule is evaluated during a case save operation, the unbounded pattern causes the server to exhaust the shared web workers servicing all tenants, resulting in a denial of service for the organization.

MicroPyramid’s BottleCRM product from version 0.43 up to and including 1.14.5 is affected. These releases use a _match_condition() routine that evaluates routing rules against incoming case data, providing the attack surface for the flaw.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The flaw requires the attacker to have administrative privileges to add a routing rule; once granted, the attacker can trigger the excessive back‑tracking during normal case processing, exhausting workers and causing a service outage across tenants. Given the need for authentication, the risk is primarily for internal threats or compromised administrator accounts, yet the impact to availability is significant.