CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely

Q: Who can exploit this issue?

An attacker must own or control a replication source or target. They can create an infinite HTTP redirect loop that the CouchDB replicator follows, causing denial of service.

Q: Which deployments are affected?

Apache CouchDB 3.5.2 and earlier are affected on all platforms. The issue is fixed in version 3.5.3.

Q: What should teams do if they cannot upgrade immediately?

The provided information does not identify a workaround. Until upgrading, limit replication relationships to trusted sources and targets, since control of either endpoint is required for exploitation.

Published Oct 20, 2026

Updated

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Affected Software

1 affected component

Apache CouchDB<=3.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CouchDB to a version that resolves this vulnerability.
Fixed in 3.5.3

Event History

Oct 20, 2026

CVE Published

via MITRE·03:39 PM

Data Sourced

via MITRE·03:39 PM

Description

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must own or control a replication source or target. They can create an infinite HTTP redirect loop that the CouchDB replicator follows, causing denial of service.

Which deployments are affected?

Apache CouchDB 3.5.2 and earlier are affected on all platforms. The issue is fixed in version 3.5.3.

What should teams do if they cannot upgrade immediately?

The provided information does not identify a workaround. Until upgrading, limit replication relationships to trusted sources and targets, since control of either endpoint is required for exploitation.

CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What should teams do if they cannot upgrade immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What should teams do if they cannot upgrade immediately?