CVE-2026-90799
Received Received - Intake

Unsafe Binary Deserialization in Apache CouchDB

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apache Software Foundation

Description
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-90799
EUVD
EUVD-2026-105158

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache CouchDB 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves unsafe binary deserialization in chttpd, a component of Apache CouchDB versions 3.5.2 and below. An authenticated user can exploit this to cause a denial of service by exhausting system memory.

Detection Guidance

Detecting this vulnerability requires checking the version of Apache CouchDB running on your system. Run the command 'couchdb --version' or check the version in the CouchDB configuration files or logs. If the version is 3.5.2 or below, the system is vulnerable.

Impact Analysis

An attacker with access could crash the CouchDB server, leading to service disruption. This may cause downtime for applications relying on the database, data unavailability, and potential loss of productivity.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that violate availability requirements in GDPR or HIPAA. Downtime may lead to breaches of data access or processing timelines, potentially resulting in penalties.

Mitigation Strategies

Upgrade Apache CouchDB to version 3.5.3 or later immediately. Follow the official Apache CouchDB upgrade documentation for your platform to ensure a smooth transition. Monitor system resources for unusual memory usage patterns as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart