Live › vulnerability › CVE-2026-90797
Go to dashboardCouchDB 3.5.2 and below decompresses gzip request bodies without a size limit in its chttpd component. A remote client can send a crafted compressed request to exhaust server memory and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any CouchDB deployment at version 3.5.2 or below on any platform is in scope, because the flaw is in the HTTP request handling layer that every client reaches. Deployments reachable only from trusted internal clients are less exposed, though the sources do not say whether gzip input from authenticated users is the only route. Teams already on 3.5.3 or later can skip it.
No product ranges from the sources yet.
curl -s http://localhost:5984/ on the CouchDB host and read the version field; anything at or below 3.5.2 is affected3.5.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-90797")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.