CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/couchdbto a version that resolves this vulnerability.Fixed in 3.5.3 - Upgrade
Upgrade
Apache CouchDBto a version that resolves this vulnerability.Fixed in 3.5.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache CouchDB 3.5.2 and earlier are affected on all platforms. Because the vulnerable endpoint is POST /_session and exploitation is pre-authentication, any deployment where a remote client can reach that endpoint is exposed.
What does an attacker need to exploit it?
No authentication or user interaction is required. A remote client can submit a gzip payload to POST /_session that triggers unlimited decompression and exhausts memory.
What is the impact of successful exploitation?
The stated impact is denial of service through memory exhaustion. The supplied CVSS vector indicates availability impact to both the vulnerable system and subsequent systems, with no stated confidentiality or integrity impact.
What should be done if a system is affected?
Upgrade Apache CouchDB to version 3.5.3, which fixes the issue. The provided information does not specify an alternative mitigation for systems that cannot yet be upgraded.