Loading vulnerability…
Infinite HTTP Redirect Loop Denial of Service in Apache CouchDB Replicator
Apache CouchDB 3.5.2 and earlier on all platforms contain a denial-of-service vulnerability in the replicator. A missing circuit-breaker allows an owner of a replication source or target to create an infinite HTTP redirect loop that the replicator fails to terminate. Apache CouchDB 3.5.3 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes denial of service through an infinite HTTP redirect loop during replication. The advisory identifies low availability impacts to the vulnerable system and subsequent systems, with no confidentiality or integrity impact.
If you can’t patch tonight, do this now.
As a temporary risk-reduction measure, restrict replication to trusted sources and targets and stop replication jobs involving endpoints suspected of generating redirect loops. These measures do not replace upgrading to the fixed version.
Patch, then assume compromise.
Upgrade Apache CouchDB to version 3.5.3, which includes the fix. Distribution packages marked as vendor-unpatched may not receive a distribution-specific fix despite the availability of the upstream fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.