Vulnerabilities

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to…

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Apache Software Foundation

Product

ZooKeeper / Cassandra / CouchDB / HBase

Fix

available

Exposure class

Database

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-90798 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 10
   CVE NVD 11d ago

   Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed…

   Fix available CVE-2026-90800 Apache Software Foundation