Key points
- Apache CouchDB versions prior to 3.5.3 are affected by a memory exhaustion flaw.
- The issue allows an authenticated user to trigger a denial of service.
- Upgrading to version 3.5.3 resolves the vulnerability.
Apache CouchDB users running versions older than 3.5.3 must update their systems immediately. The software vendor has released version 3.5.3 to address a security flaw that allows an authenticated user to crash the service. This vulnerability is present in all platforms running the affected versions. The fix is available for download now.
In plain English
The problem occurs in the chttpd component of Apache CouchDB. An attacker who has already logged into the system can send specially crafted requests. These requests cause the application to consume all available memory. When memory is exhausted, the service stops working. This results in a denial of service for all users. The flaw does not require high-level administrative privileges to exploit.
The background
The issue was documented in an advisory posted to the oss-security mailing list. Jan Lehnardt published the details on October 20. The vulnerability is tracked as CVE-2026-90799. It involves unsafe binary deserialization in change sequences and search bookmarks. The CVSS score is 4.0, which is rated as low severity. The vector requires network access and low privileges.
What changes now
Administrators should verify their current Apache CouchDB version. If the version number is lower than 3.5.3, an update is required. The vendor recommends upgrading to version 3.5.3 to mitigate the risk. This update patches the unsafe deserialization behavior. No other workarounds are mentioned in the official advisory. Users should apply the patch as soon as possible.
Who needs to act first
Teams usually prioritize systems exposed to the internet or internal networks with many users. Check whether your CouchDB instances accept connections from untrusted sources. Test the update in a non-production environment first to ensure stability. Back up your databases before applying the patch. If you cannot update immediately, restrict access to the service. Monitor logs for unusual memory usage patterns. Reduce the number of authenticated sessions where possible.
What to do and how to stay safe: Apache CouchDB
- Verify your Apache CouchDB version and compare it to 3.5.3.
- Download and install the 3.5.3 update on affected servers.
- Restrict network access to CouchDB if you cannot patch immediately.
- Monitor system memory usage for signs of exhaustion.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is identified as CVE-2026-90799.
Which versions of Apache CouchDB are affected?
All versions of Apache CouchDB before 3.5.3 are affected.
Is there a fix available for this issue?
Yes, upgrading to version 3.5.3 fixes the issue.
