CouchDB replicator before 3.5.3 follows redirects without a limit
Original title: CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely
The owner of a replication source or target can force a denial of service with an infinite HTTP redirect loop.
CVE-2026-90798 affects Apache CouchDB 3.5.2 and below on all platforms. A missing circuit-breaker in the replicator lets the owner of a replication source or target cause denial of service by creating an infinite HTTP redirect loop. Affected versions are those before 3.5.3. Severity is moderate, with CVSS 4.0 0.6 (low).
Unconfirmed: The upgrade recommendation is truncated in the snippet.
- Only the replication source or target owner can trigger it.
- Impact is limited to low availability.
- The advisory labels severity moderate despite the 0.6 CVSS score.
Impact: Replication owner causes denial of service via redirect loop
| Product | Affected | Fixed in |
|---|---|---|
| Apache CouchDB | 3.5.2 and below (before 3.5.3) | 3.5.3 |
- 1.Upgrade Apache CouchDB to 3.5.3.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90798 | A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a… | 0.6 | — |
From the original article
Posted by Jan Lehnardt on Oct 20 Severity: moderate CVSS 4. 0: 0. 6 (low) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.