Apache CouchDB 3.5.2 and below: Repl No Circuit Breaker Infinite Redirect DoS
CVE-2026-90798 Published on October 20, 2026

Apache CouchDB: Replicator follows redirects indefinitely
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-90798 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE

Products Associated with CVE-2026-90798

Want to know whenever a new CVE is published for Apache Couchdb? stack.watch will email you.

Apache Couchdb
 

Affected Versions

Apache Software Foundation Apache CouchDB: