Vulnerability · Published Oct 20, 2026 · Assigned by apache
CVE-2026-90798Apache CouchDB: Replicator follows redirects indefinitely
Low 0.6
In plain English
A low-severity security flaw in Apache CouchDB from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 4.0)0.6Low
Exploit odds (30 days)0.6%top 51.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CouchDB | 0 – before 3.5.3 |
Weakness: CWE-834 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber