HIGH 7.7 NVD
CVE-2026-90797
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via m
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
References
- https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
- https://lists.apache.org/thread/gsbotof0qn8x6zlpd7t568ny4053jo0n
- https://www.openwall.com/lists/oss-security/2026/10/20/12
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-10-20 via NVD.
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.