CVE-2026-90798
Apache CouchDB: Replicator follows redirects indefinitely
Apache Software Foundation Apache CouchDBDatabases
CVSS
0.6LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.60%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.5.3Apache CouchDBCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Text from CVE List
Affected versions 1
- Apache CouchDBaffected: all versions before 3.5.3CVE List