CVE-2026-90798

EUVD-2026-105157
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
0.6 LOW
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
Base Score
CVSS 3.x
EPSS Score
Percentile: 47.73%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apachecouchdb
𝑥
< 3.5.3
CNA
Common Weakness Enumeration
References
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
https://lists.apache.org/thread/m6d526fj57pvq5pswm2lp1shbdz3f417
http://www.openwall.com/lists/oss-security/2026/10/20/13