CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
Published Oct 20, 2026
·Updated
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Affected Software
3 affected componentsFixes available
Apache CouchDB<=3.5.2
bitnami/couchdb<3.5.3
3.5.3
ubuntu/couchdb*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/couchdbto a version that resolves this vulnerability.Fixed in 3.5.3 - Upgrade
Upgrade
Apache CouchDBto a version that resolves this vulnerability.Fixed in 3.5.3
Event History
Oct 20, 2026
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
Description
Data Sourced
via OSV·04:17 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Oct 29, 2026
Advisory Published
via OSV·08:39 AM
Frequently Asked Questions
1
Does an attacker need to authenticate to exploit this issue?
Yes. Exploitation requires an authenticated Apache CouchDB user account.
2
Which deployments are affected?
Apache CouchDB 3.5.2 and earlier are affected on all platforms.
3
What is the recommended remediation?
Upgrade Apache CouchDB to version 3.5.3, which fixes the issue.