CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/couchdbto a version that resolves this vulnerability.Fixed in 3.5.3 - Upgrade
Upgrade
Apache CouchDBto a version that resolves this vulnerability.Fixed in 3.5.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must own or control a replication source or target. They can create an infinite HTTP redirect loop that the CouchDB replicator follows, causing denial of service.
Which deployments are affected?
Apache CouchDB 3.5.2 and earlier are affected on all platforms. The issue is fixed in version 3.5.3.
What should teams do if they cannot upgrade immediately?
The provided information does not identify a workaround. Until upgrading, limit replication relationships to trusted sources and targets, since control of either endpoint is required for exploitation.