7.7High
CVE-2026-90797Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
Description
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Weakness (CWE):
CWE-409
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Apache Software Foundation | Apache CouchDB | < 3.5.3 |