CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

Q: Which deployments are exposed to this issue?

Apache CouchDB 3.5.2 and earlier are affected on all platforms. Because the vulnerable endpoint is POST /_session and exploitation is pre-authentication, any deployment where a remote client can reach that endpoint is exposed.

Q: What does an attacker need to exploit it?

No authentication or user interaction is required. A remote client can submit a gzip payload to POST /_session that triggers unlimited decompression and exhausts memory.

Q: What is the impact of successful exploitation?

The stated impact is denial of service through memory exhaustion. The supplied CVSS vector indicates availability impact to both the vulnerable system and subsequent systems, with no stated confidentiality or integrity impact.

Q: What should be done if a system is affected?

Upgrade Apache CouchDB to version 3.5.3, which fixes the issue. The provided information does not specify an alternative mitigation for systems that cannot yet be upgraded.

Published Oct 20, 2026

Updated

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Affected Software

1 affected component

Apache CouchDB<=3.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CouchDB to a version that resolves this vulnerability.
Fixed in 3.5.3

Event History

Oct 20, 2026

CVE Published

via MITRE·03:39 PM

Data Sourced

via MITRE·03:39 PM

Description

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache CouchDB 3.5.2 and earlier are affected on all platforms. Because the vulnerable endpoint is POST /_session and exploitation is pre-authentication, any deployment where a remote client can reach that endpoint is exposed.

What does an attacker need to exploit it?

No authentication or user interaction is required. A remote client can submit a gzip payload to POST /_session that triggers unlimited decompression and exhausts memory.

What is the impact of successful exploitation?

The stated impact is denial of service through memory exhaustion. The supplied CVSS vector indicates availability impact to both the vulnerable system and subsequent systems, with no stated confidentiality or integrity impact.

What should be done if a system is affected?

Upgrade Apache CouchDB to version 3.5.3, which fixes the issue. The provided information does not specify an alternative mitigation for systems that cannot yet be upgraded.

CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should be done if a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should be done if a system is affected?