Key points
- CVE-2026-90797 affects Apache CouchDB versions prior to 3.5.3.
- The vulnerability allows pre-authentication denial of service via memory exhaustion.
- Apache CouchDB 3.5.3 includes a fix for this high-severity issue.
Jan Lehnardt posted an advisory on October 20 detailing CVE-2026-90797, a high-severity vulnerability in Apache CouchDB. The flaw exists in the chttpd component and allows any remote client to trigger a denial of service. Attackers can exploit this issue without authentication by sending specific requests to the server.
The vulnerability stems from an unlimited gzip decompression routine. According to the official advisory on the oss-security mailing list, this mechanism allows remote clients to cause memory exhaustion. The CVSS score is 7.7, which classifies the severity as high. The attack vector is network-based, and the complexity is low, making it easy to exploit.
Context and Background
This issue impacts the session management endpoint of the database server. Specifically, the POST /_session route is vulnerable to the decompression bomb attack. The flaw allows an attacker to send a small compressed payload that expands significantly in memory. This results in the server running out of available memory resources, leading to a crash or unavailability.
Who Is Affected
Apache CouchDB versions before 3.5.3 are affected by this vulnerability. The issue exists on all platforms where these older versions are deployed. Users running version 3.5.2 or earlier are exposed to remote exploitation. The advisory explicitly states that versions prior to 3.5.3 contain the vulnerable code in the chttpd module.
Next steps
Users are recommended to upgrade to Apache CouchDB version 3.5.3 immediately. This update fixes the unlimited gzip decompression routine issue. Administrators should verify their current version to ensure they are not running vulnerable software. Delaying the update leaves systems open to denial of service attacks from any remote client.
Signals worth monitoring
Teams usually observe sudden spikes in memory usage on database servers during active exploitation. Check whether the chttpd process is consuming excessive resources without corresponding legitimate traffic. Look for unusual POST requests to the session endpoint from unknown IP addresses. Verify if the server becomes unresponsive shortly after receiving small compressed payloads. Monitor system logs for out-of-memory errors or service restarts. Confirm that no unauthorized access attempts precede the resource exhaustion events.
What to do and how to stay safe: Apache CouchDB
- Verify your Apache CouchDB version and upgrade to 3.5.3 if you are running an older release.
- Monitor server memory usage for sudden, unexplained spikes that could indicate decompression attacks.
- Restrict network access to the CouchDB session endpoint to trusted IP addresses where possible.
- Review server logs for POST requests to /_session that originate from unexpected sources.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Apache CouchDB versions are vulnerable to CVE-2026-90797?
All versions of Apache CouchDB before 3.5.3 are affected by this vulnerability.
What is the severity rating of this vulnerability?
The vulnerability has a CVSS score of 7.7, which is rated as high severity.
Is there a fix available for this issue?
Yes, users should upgrade to Apache CouchDB version 3.5.3 to resolve the issue.
