CVE-2026-90798
Apache CouchDB: Replicator follows redirects indefinitely
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache CouchDB: Replicator follows redirects indefinitely
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- Record
CVE-2026-90798- CVSS 4.0
- 0.6 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-834
- Updated
- 2026-11-02
EUVDEUVD-2026-105157
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- Record
EUVD-2026-105157- CVSS 4.0
- 0.6 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7926-69mg-83fh
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms...
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- Record
GHSA-7926-69mg-83fh- CVSS 4.0
- 0.6 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-834
- Updated
- 2026-11-02
NVD
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- Record
CVE-2026-90798- CVSS 4.0
- 0.6 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-834
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-90798
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- Record
UBUNTU-CVE-2026-90798- CVSS 4.0
- 0.6 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Updated
- 2026-11-02
OSVBIT-couchdb-2026-90798 No score
Apache CouchDB: Replicator follows redirects indefinitely
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- Record
BIT-couchdb-2026-90798- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-90798 is a low vulnerability (CVSS 0.6) in Apache Software Foundation Couchdb, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in couchdb 3.5.3.
References
lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
openwall.com/lists/oss-security/2026/10/20/13
nvd.nist.gov/vuln/detail/CVE-2026-90798
github.com/advisories/GHSA-7926-69mg-83fh
ubuntu.com/security/CVE-2026-90798
cve.org/CVERecord?id=CVE-2026-90798