CouchDB before 3.5.3 allows pre-auth gzip DoS (CVE-2026-90797)
Original title: CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
Any remote client can exhaust memory through unlimited gzip decompression on POST /_session; 3.5.3 fixes it.
Jan Lehnardt reported CVE-2026-90797 in Apache CouchDB on October 20. An unlimited gzip decompression routine in chttpd on version 3.5.2 and below, on all platforms, lets any remote client cause a denial of service by exhausting memory. CVSS 4.0 is 7.7 (high). Users are told to upgrade to 3.5.3.
- The issue is reached through POST /_session before authentication.
- Affected releases are Apache CouchDB 3.5.2 and below on all platforms.
- The fixed release is 3.5.3.
- The published vector includes exploit maturity Unreported (E:U).
Impact: Unauthenticated remote denial of service via memory exhaustion
| Product | Affected | Fixed in |
|---|---|---|
| Apache CouchDB | 3.5.2 and below | 3.5.3 |
- 1.Upgrade Apache CouchDB to 3.5.3.
- CVEs
- CVE-2026-90797
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90797 | Unauthenticated gzip decompression DoS in Apache CouchDB | 7.7 | — |
From the original article
Posted by Jan Lehnardt on Oct 20 Severity: CVSS 4. 0: 7. 7 (high) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.