{"id":"CVE-2026-90798","kind":"vulnerability","aliases":["CVE-2026-90798"],"related":[],"title":"Apache CouchDB: replicator loops forever on redirects, causing denial of service","description":"A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.","summary":"Apache CouchDB 3.5.2 and earlier lack a circuit breaker in the replicator, so a replication source or target that issues an infinite HTTP redirect loop can stall replication. An attacker who owns a replication endpoint can make the database spend resources on it, causing denial of service.","severity":"low","cvss":0.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["couchdb","package","replication","self-hosted"],"not_affected_if":["managed-hosting","no-replication"],"how_to_check":"- Run `curl -s http://localhost:5984/` (or your CouchDB address) and read the `version` field; it is affected at `3.5.2` and below.\n- Check the replicator database for replication jobs whose source or target you do not recognise.","fix":"- Upgrade Apache CouchDB to `3.5.3` or later.\n- Until then, only create replications to endpoints you control or trust.","status":"open","published_at":"2026-10-20T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:50:08+00:00","updated_at":"2026-10-25T04:50:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:50:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache CouchDB to `3.5.3` or later.\n- Until then, only create replications to endpoints you control or trust.","reach":"network","title":"Apache CouchDB: replicator loops forever on redirects, causing denial of service","impact":"low","summary":"Apache CouchDB 3.5.2 and earlier lack a circuit breaker in the replicator, so a replication source or target that issues an infinite HTTP redirect loop can stall replication. An attacker who owns a replication endpoint can make the database spend resources on it, causing denial of service.","category":"package","nicknames":[],"who_cares":["couchdb","self-hosted","replication"],"confidence":0.7,"needs_auth":"yes","worst_case":"Replication jobs hang in a redirect loop, denying service to the database.","analyst_note":"","how_to_check":"- Run `curl -s http://localhost:5984/` (or your CouchDB address) and read the `version` field; it is affected at `3.5.2` and below.\n- Check the replicator database for replication jobs whose source or target you do not recognise.","needs_analyst":false,"not_affected_if":["managed-hosting","no-replication"],"who_is_affected":"Any CouchDB 3.5.2 or earlier deployment on any platform that runs replication, since the flaw is in the replicator. The sources say the attacker must own a replication source or target, so a server that only serves local data with no untrusted replication endpoints is at lower risk. Teams on a managed CouchDB service or with replication disabled can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000615,"input_tokens":3329,"output_tokens":565,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-90798':14A,17A '3.5.2':26B,82C '3.5.3':117C 'allow':88C 'apach':1A,24B,80C 'attack':53B 'breaker':32B,75C 'caus':8A,67B,98C 'circuit':31B,74C 'circuit-break':73C 'couchdb':2A,18B,25B,81C 'creat':104C 'cve':12A,15A 'databas':62B 'denial':9A,68B,100C 'earlier':28B 'endpoint':58B 'fix':119C 'forev':5A 'host':23B 'http':46B,107C 'infinit':45B,106C 'issu':43B,121C 'lack':29B 'loop':4A,48B,109C 'make':60B 'miss':72C 'own':55B 'owner':90C 'packag':19B 'platform':87C 'recommend':112C 'redirect':7A,47B,108C 'replic':3A,20B,35B,38B,51B,57B,78C,93C 'resourc':64B 'self':22B 'self-host':21B 'servic':11A,70B,102C 'sourc':39B,94C 'spend':63B 'stall':50B 'target':41B,96C 'upgrad':114C 'user':110C 'version':116C 'via':103C","nicknames":[],"mitigations":[],"who_affected":"Any CouchDB 3.5.2 or earlier deployment on any platform that runs replication, since the flaw is in the replicator. The sources say the attacker must own a replication source or target, so a server that only serves local data with no untrusted replication endpoints is at lower risk. Teams on a managed CouchDB service or with replication disabled can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90798","severity":null,"published_at":"2026-10-20T16:17:15+00:00","modified_at":"2026-10-20T19:34:00+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}