Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache CouchDB

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-90800

    Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

    Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very r…

    Apache Software Foundation Apache CouchDB couchdb Ubuntu
  • High 7.7
    CVE-2026-90797

    Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

    An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

    Apache Software Foundation Apache CouchDB couchdb Ubuntu