Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhighExploited in the wild

Apache CouchDB 3.5.3 fixes six flaws in 3.5.2 and earlier

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Apache CouchDB 3.5.3 fixes six flaws in 3.5.2 and earlier, including admin command execution and pre-auth denial of service.

Jan Lehnardt reported six Apache CouchDB vulnerabilities on October 20, all affecting 3.5.2 and earlier on all platforms. The stated fix is 3.5.3. CVE-2026-86471 lets a server admin run arbitrary shell commands as the CouchDB OS user; CVSS 4.0 is 9.3, and the published vector sets exploit maturity to Attacked. CVE-2026-90797 lets any remote client exhaust memory through unlimited gzip decompression on POST /_session (CVSS 7.7, maturity Unreported). CVE-2026-90800 lets any request read prefixed _users or _replicator databases (CVSS 8.1). The other issues are an infinite replicator redirect loop, unsafe deserialization causing memory exhaustion, and disclosure of other users' replication credentials.

Key facts
  • Affected releases are Apache CouchDB 3.5.2 and earlier on all platforms.
  • Version 3.5.3 is the stated fix for all six CVEs.
  • CVE-2026-86471 needs server admin credentials; commands run as the OS user.
  • CVE-2026-90797 is reachable before authentication through POST /_session.
  • CVE-2026-90800 requires no privileges and exposes prefixed system databases.
  • CVE-2026-90798 is labeled moderate despite a CVSS 4.0 score of 0.6.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026Six CouchDB advisories published; 3.5.3 is the fix · oss-security

What each outlet adds

beyond the shared facts
  • oss-securitySix advisories with CVSS scores, vectors, and privilege requirements
CVEs
CVE-2026-90800CVE-2026-86471CVE-2026-90797CVE-2026-107755CVE-2026-90799CVE-2026-90798
Vendors
Apache
Products
Apache CouchDBCouchDB

Coverage

oldest first · one row per article · UTC
  1. · 22d ago oss-securityFirst report

    CouchDB before 3.5.3 lets admins run shell commands (CVE-2026-86471)

    A CouchDB server admin can execute arbitrary shell commands as the CouchDB OS user; upgrade to 3.5.3.

  2. · 22d ago oss-security

    CouchDB before 3.5.3 allows pre-auth gzip DoS (CVE-2026-90797)

    Any remote client can exhaust memory through unlimited gzip decompression on POST /_session; 3.5.3 fixes it.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-107755
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read…
6.0—
CVE-2026-86471
+2 related CVEs
CVE-2026-90800CVE-2026-90797
OS command injection in Apache CouchDB admin config
9.3
group max
—
CVE-2026-90798
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a…
0.6—
CVE-2026-90799
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory…
1.3—