Loading vulnerability…
Gzip Decompression Denial of Service in Apache CouchDB chttpd
CVE-2026-90797 affects Apache CouchDB 3.5.2 and earlier on all platforms. An unlimited gzip decompression routine in the chttpd component allows an unauthenticated remote client to submit a highly compressed request that expands excessively during decompression, exhausting server memory and causing denial of service. Apache CouchDB 3.5.3 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exhausts server memory and disrupts CouchDB availability. The established impact is denial of service; confidentiality or integrity compromise is not demonstrated.
Patch, then assume compromise.
Upgrade Apache CouchDB to version 3.5.3 or a later release containing the fix. For distribution packages without a vendor-supplied patch, including the identified Ubuntu 16.04 LTS package, migrate to a supported deployment providing a fixed CouchDB version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.