Live › vulnerability › CVE-2026-90799
Go to dashboardApache CouchDB 3.5.2 and below deserialises untrusted binary data in its chttpd HTTP layer without safe limits. An authenticated user can exhaust server memory and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any team running Apache CouchDB 3.5.2 or earlier where users can make authenticated HTTP requests to the chttpd endpoint, including self-hosted and shared deployments. Deployments where only fully trusted operators hold accounts face little practical risk, and managed hosts will patch on their own schedule.
No product ranges from the sources yet.
curl -s http://localhost:5984/ on the CouchDB host and read the version field; anything at or below 3.5.2 is affected.couchdb --version if the binary is on the path.3.5.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-90799")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.