SB2026102320 - Multiple vulnerabilities in Apache CouchDB

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102320

SB2026102320 - Multiple vulnerabilities in Apache CouchDB

Published: October 23, 2026

Security Bulletin ID SB2026102320
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-86471)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary shell commands as the CouchDB operating system user.

The vulnerability exists due to improper input validation in Apache CouchDB's runtime configuration handling when processing configuration values. A remote privileged user can supply a malicious runtime configuration value to execute arbitrary shell commands as the CouchDB operating system user.


2) Improper handling of highly compressed data (CVE-ID: CVE-2026-90797)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to unlimited gzip decompression in the Apache CouchDB chttpd component when processing gzip-compressed POST requests to /_session. A remote attacker can send a gzip decompression bomb to exhaust server memory and cause a denial of service.


3) Infinite loop (CVE-ID: CVE-2026-90798)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a missing circuit-breaker in the Apache CouchDB replicator when following HTTP redirects. A remote user can configure a replication source or target under their control to create an infinite HTTP redirect loop to cause a denial of service.


4) Deserialization of Untrusted Data (CVE-ID: CVE-2026-90799)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service through memory exhaustion.

The vulnerability exists due to unsafe binary deserialization in the chttpd component of Apache CouchDB when processing _changes sequence values and _search bookmarks. A remote user can submit specially crafted sequence values to exhaust the atom table and cause a denial of service.


5) Missing Authorization (CVE-ID: CVE-2026-90800)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read the full contents of prefixed system databases in Apache CouchDB without authorization.

The vulnerability exists due to missing authorization checks in chttpd when handling requests to an API endpoint for prefixed _users or _replicator databases. A remote attacker can send a request to the endpoint to read the full contents of these databases without authorization.


6) Information disclosure (CVE-ID: CVE-2026-107755)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read replication credentials belonging to other users.

The vulnerability exists due to insufficient filtering of credentials in the Apache CouchDB _replicator database when handling object-form replication endpoint URLs. A remote user can read credentials from other users’ replication documents to disclose sensitive authentication information.


Remediation

Install update from vendor's website.

References