Loading vulnerability…
Authenticated denial of service in Apache CouchDB chttpd binary deserialization
CVE-2026-90799 is an unsafe binary deserialization vulnerability in the chttpd component of Apache CouchDB 3.5.2 and earlier on all platforms. An authenticated user can submit specially crafted _changes sequence values or _search bookmarks to trigger atom-table exhaustion, resulting in memory exhaustion and denial of service. Apache CouchDB 3.5.3 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exhausts atom-table resources and memory, causing denial of service and disrupting CouchDB availability. No confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
No interim mitigation or workaround is specified.
Patch, then assume compromise.
Upgrade Apache CouchDB to version 3.5.3, which fixes the vulnerability. Where a distribution does not provide a patched package, move to a supported deployment that includes the upstream fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.