CVE-2026-90797

7.7High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.7High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-409

Impact

Remote unauthenticated attackers can crash CouchDB by exhausting system memory over the network. They only need access to send requests to the chttpd HTTP port.

Root cause

The chttpd component decompresses gzip payloads without an upper bound on decompressed size.

Affected systems

Apache CouchDB 3.5.2 and below on all platforms

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:M/U:Red

Fix & remediation

Upgrade to CouchDB version 3.5.3. If you cannot patch immediately, block untrusted network access to CouchDB's HTTP port or restrict compressed request payloads at a reverse proxy.

shell

$ couchdb -V

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-90797