Live › vulnerability › CVE-2026-90798
Go to dashboardApache CouchDB 3.5.2 and earlier lack a circuit breaker in the replicator, so a replication source or target that issues an infinite HTTP redirect loop can stall replication. An attacker who owns a replication endpoint can make the database spend resources on it, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any CouchDB 3.5.2 or earlier deployment on any platform that runs replication, since the flaw is in the replicator. The sources say the attacker must own a replication source or target, so a server that only serves local data with no untrusted replication endpoints is at lower risk. Teams on a managed CouchDB service or with replication disabled can skip it.
No product ranges from the sources yet.
curl -s http://localhost:5984/ (or your CouchDB address) and read the version field; it is affected at 3.5.2 and below.3.5.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-90798")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.