The vulnerability arises because BottleCRM’s _read_upload() function copies the entire CSV payload into memory before applying the 5 MB restriction. An attacker with a mass‑import role can therefore submit oversized CSV files to the /api/contacts/import/ and /api/cases/import/ endpoints, causing worker processes to drain memory and eventually terminate. The weakness is classified as CWE‑770, uncontrolled memory allocation, and results in service disruption rather than data compromise.

MicroPyramid BottleCRM versions 0.45 through 1.14.5 are affected. These releases include the unprotected CSV import routines that allow contingent file sizes to be processed without initial validation.

With a CVSS score of 5.3 the vulnerability is moderate in severity. The EPSS score of < 1% indicates a low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the mass‑import privilege and the ability to send multiple large CSVs concurrently. It can lead to out‑of‑memory termination of worker threads, causing a denial of service to all users. The attack is feasible against any instance exposing these import endpoints to authorized users.