CouchDB before 3.5.3 can exhaust memory via crafted sequences
Original title: CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
An authenticated user can trigger denial of service through unsafe binary deserialization in chttpd.
CVE-2026-90799 affects Apache CouchDB 3.5.2 and below on all platforms. Unsafe binary deserialization in chttpd lets an authenticated user cause denial of service by memory exhaustion using specially crafted sequence values in _changes sequences and _search bookmarks. Users are recommended to upgrade to 3.5.3. CVSS 4.0 is 1.3 (low).
- Availability impact is low; confidentiality and integrity are none.
- The issue requires low privileges and no user interaction.
- Version 3.5.3 is the stated fix.
Impact: Authenticated denial of service via memory exhaustion
| Product | Affected | Fixed in |
|---|---|---|
| Apache CouchDB | 3.5.2 and below (before 3.5.3) | 3.5.3 |
- 1.Upgrade Apache CouchDB to version 3.5.3.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90799 | Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory… | 1.3 | — |
From the original article
Posted by Jan Lehnardt on Oct 20 Severity: CVSS 4. 0: 1. 3 (low) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.