BIT-couchdb-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

Q: Who can exploit this issue?

An attacker must be authenticated to the affected Apache CouchDB instance. The issue is remotely reachable, but it does not require user interaction.

Q: Which deployments are affected?

Apache CouchDB 3.5.2 and earlier are affected on all platforms. The listed software package is bitnami/couchdb.

Q: What is the impact of successful exploitation?

A crafted sequence value can trigger unsafe binary deserialization in chttpd and exhaust memory, causing a denial of service.

Q: What should teams do to remediate the issue?

Upgrade Apache CouchDB to version 3.5.3, which fixes the vulnerability.

Published Oct 29, 2026

Updated

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Affected Software

1 affected componentFixes available

bitnami/couchdb<3.5.3

3.5.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/couchdb to a version that resolves this vulnerability.
Fixed in 3.5.3
Upgrade
Upgrade Apache CouchDB to a version that resolves this vulnerability.
Fixed in 3.5.3

Event History

Oct 29, 2026

Advisory Published

via OSV·08:39 AM

Data Sourced

via OSV·08:39 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to the affected Apache CouchDB instance. The issue is remotely reachable, but it does not require user interaction.

Which deployments are affected?

Apache CouchDB 3.5.2 and earlier are affected on all platforms. The listed software package is bitnami/couchdb.

What is the impact of successful exploitation?

A crafted sequence value can trigger unsafe binary deserialization in chttpd and exhaust memory, causing a denial of service.

What should teams do to remediate the issue?

Upgrade Apache CouchDB to version 3.5.3, which fixes the vulnerability.

BIT-couchdb-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the impact of successful exploitation?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the impact of successful exploitation?

What should teams do to remediate the issue?