Apache CouchDB 3.5.3 fixes four flaws in 3.5.2 and earlier
First merged summary.
Apache CouchDB 3.5.2 and earlier has four flaws, including a high-severity auth bypass; 3.5.3 is the stated fix.
Four Apache CouchDB advisories published on October 20, 2026, cover every platform through version 3.5.2 and recommend upgrading to 3.5.3. CVE-2026-90800 is the most severe: missing chttpd authorization checks let any network request read the full contents of a prefixed _users or _replicator database, scored CVSS 4.0 8.1 (high). CVE-2026-107755, reported by Jan Lehnardt, lets an authenticated user read other users’ replication credentials and is rated important at CVSS 4.0 6.0. Two lower-severity denial-of-service issues remain: CVE-2026-90798, an infinite HTTP redirect loop available only to a replication source or target owner (CVSS 4.0 0.6, labeled moderate), and CVE-2026-90799, atom-table exhaustion via crafted sequence values (CVSS 4.0 1.3).
- Affected releases are Apache CouchDB 3.5.2 and below; 3.5.3 is the fix.
- CVE-2026-90800 needs no privileges and rates confidentiality and integrity high.
- CVE-2026-107755 exposes other users’ replication credentials to an authenticated user.
- CVE-2026-90798 is limited to the replication source or target owner.
- CVE-2026-90799 requires low privileges and no user interaction.
- The redirect-loop advisory is labeled moderate despite a 0.6 CVSS 4.0 score.
Timeline
dated events in the reporting · oldest first- Oct 20, 2026Four CouchDB advisories published for versions through 3.5.2. · oss-security
What each outlet adds
beyond the shared facts- oss-securityDetails all four CVEs, CVSS scores, and the 3.5.3 fix.
Coverage
oldest first · one row per article · UTC- · 22d ago
oss-securityFirst report
CouchDB replicator before 3.5.3 follows redirects without a limit
The owner of a replication source or target can force a denial of service with an infinite HTTP redirect loop.
- · 22d ago
CouchDB before 3.5.3 can exhaust memory via crafted sequences
An authenticated user can trigger denial of service through unsafe binary deserialization in chttpd.
- · 22d ago
CouchDB before 3.5.3 allows unauthenticated reads of prefixed system DBs
Missing checks in chttpd expose the full contents of prefixed _users or _replicator databases.
- · 22d ago
CouchDB before 3.5.3 leaks other users' replication credentials
An authenticated user can read replication credentials stored for other users in the _replicator database.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107755 | Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read… | 6.0 | — | ||
| CVE-2026-90798 | A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a… | 0.6 | — | ||
| CVE-2026-90799 | Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory… | 1.3 | — | ||
| CVE-2026-90800 | Missing auth checks in Apache CouchDB prefixed system DBs | 8.1 | — |