LOW 1.3 NVD
CVE-2026-90799
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
References
- https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
- https://lists.apache.org/thread/bqxkm19hw8985t7opz675b29hs1zl4z9
- https://www.openwall.com/lists/oss-security/2026/10/20/14
This low severity vulnerability with a CVSS score of 1.3 was published on 2026-10-20 via NVD.
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.