CVE-2026-90799

UNKNOWN 0.0

Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Vendor	apache software foundation
Product	apache couchdb
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache couchdb

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache couchdb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache CouchDB

0 < 3.5.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f lists.apache.org: https://lists.apache.org/thread/bqxkm19hw8985t7opz675b29hs1zl4z9

Credits

Piotr Karwasz & ZeroVuln Labs reported this issue independently