{"id":"CVE-2026-90797","kind":"vulnerability","aliases":["CVE-2026-90797"],"related":[],"title":"Apache CouchDB: unlimited gzip decompression lets remote clients exhaust memory","description":"An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.","summary":"CouchDB 3.5.2 and below decompresses gzip request bodies without a size limit in its chttpd component. A remote client can send a crafted compressed request to exhaust server memory and cause a denial of service.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["couchdb","database","package","self-hosted"],"not_affected_if":["version-3.5.3-or-later"],"how_to_check":"- Run `curl -s http://localhost:5984/` on the CouchDB host and read the `version` field; anything at or below `3.5.2` is affected\n- Check whether the node accepts gzip-encoded request bodies from untrusted clients (the sources do not name a specific setting)","fix":"- Upgrade Apache CouchDB to `3.5.3`","status":"open","published_at":"2026-10-20T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:10:48+00:00","updated_at":"2026-10-25T03:10:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:10:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache CouchDB to `3.5.3`","reach":"internet","title":"Apache CouchDB: unlimited gzip decompression lets remote clients exhaust memory","impact":"low","summary":"CouchDB 3.5.2 and below decompresses gzip request bodies without a size limit in its chttpd component. A remote client can send a crafted compressed request to exhaust server memory and cause a denial of service.","category":"package","nicknames":[],"who_cares":["couchdb","self-hosted","database"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote client exhausts server memory, causing denial of service","analyst_note":"","how_to_check":"- Run `curl -s http://localhost:5984/` on the CouchDB host and read the `version` field; anything at or below `3.5.2` is affected\n- Check whether the node accepts gzip-encoded request bodies from untrusted clients (the sources do not name a specific setting)","needs_analyst":false,"not_affected_if":["version-3.5.3-or-later"],"who_is_affected":"Any CouchDB deployment at version 3.5.2 or below on any platform is in scope, because the flaw is in the HTTP request handling layer that every client reaches. Deployments reachable only from trusted internal clients are less exposed, though the sources do not say whether gzip input from authenticated users is the only route. Teams already on 3.5.3 or later can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0006,"input_tokens":3317,"output_tokens":536,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-90797':13A,16A '3.5.2':24B,68C '3.5.3':94C 'allow':74C 'apach':1A,66C 'bodi':30B 'caus':53B,79C 'chttpd':37B,64C 'client':8A,41B,77C 'compon':38B 'compress':46B 'couchdb':2A,17B,23B,67C 'craft':45B 'cve':11A,14A 'databas':18B 'decompress':5A,27B,61C 'denial':55B,81C 'exhaust':9A,49B,86C 'fix':96C 'gzip':4A,28B,60C 'host':22B 'issu':98C 'let':6A 'limit':34B 'memori':10A,51B,85C 'packag':19B 'platform':73C 'recommend':89C 'remot':7A,40B,76C 'request':29B,47B 'routin':62C 'self':21B 'self-host':20B 'send':43B 'server':50B 'servic':57B,83C 'size':33B 'unlimit':3A,59C 'upgrad':91C 'user':87C 'version':93C 'via':84C 'without':31B","nicknames":[],"mitigations":[],"who_affected":"Any CouchDB deployment at version 3.5.2 or below on any platform is in scope, because the flaw is in the HTTP request handling layer that every client reaches. Deployments reachable only from trusted internal clients are less exposed, though the sources do not say whether gzip input from authenticated users is the only route. Teams already on 3.5.3 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:M/U:Red","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90797","severity":null,"published_at":"2026-10-20T16:17:15+00:00","modified_at":"2026-10-20T19:34:00+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}