Apache CouchDB 3.5.3 Fixes High-Severity Decompression Bomb Vulnerability

Apache CouchDB versions before 3.5.3 are affected by a high-severity vulnerability that allows remote attackers to cause denial-of-service conditions. The flaw, identified as CVE-2026-90797, exists in the chttpd component and enables an unlimited gzip decompression routine to exhaust system memory. According to the official advisory posted to the oss-security mailing list, any remote client can trigger this issue without authentication.

How it unfolded

• Jan Lehnardt posted the security advisory to the oss-security mailing list on October 20.
• The report identified CVE-2026-90797 as a high-severity issue with a CVSS 4.0 score of 7.7.
• Apache CouchDB version 3.5.3 was released to fix the unlimited gzip decompression routine in chttpd.

Who is affected

Organizations running Apache CouchDB version 3.5.2 or any earlier release are vulnerable to this attack vector. The advisory states that the issue affects all platforms where these versions are deployed. Because the vulnerability allows pre-authentication access, any remote client can initiate the denial-of-service condition. The flaw specifically targets the memory management of the gzip decompression process within the chttpd module.

Our take on the response

The vendor has provided a clear remediation path by releasing version 3.5.3, which addresses the memory exhaustion issue. The advisory recommends that users upgrade to this specific version to mitigate the risk. With a CVSS score of 7.7, the severity is classified as high, indicating a significant impact on availability. The lack of authentication requirements for exploitation makes this a critical priority for exposed systems.

Who needs to act first

Teams should prioritize updating systems that are directly accessible from the internet or untrusted networks. Before applying the update, verify that the current version is indeed below 3.5.3. It is advisable to test the upgrade in a non-production environment first to ensure stability. Back up configuration files and databases prior to the update process. If immediate patching is not possible, consider restricting network access to the service using firewall rules.

Background: Firewall rules

Firewall rules Linux systems use are ordered instructions that decide whether network packets enter or leave. They inspect source, destination, and protocol data. You must configure these rules to allow necessary services while blocking unauthorized access attempts.

Read the full guide: Firewall Rules Linux: How Packet Filtering Shapes Network Security

What to do and how to stay safe: Apache CouchDB

• Identify all instances of Apache CouchDB running versions prior to 3.5.3 across your infrastructure.
• Upgrade affected systems to version 3.5.3 as soon as possible to apply the vendor-provided fix.
• Monitor system logs for signs of memory exhaustion or unexpected service interruptions that may indicate exploitation attempts.
• Restrict network access to CouchDB services to trusted IP ranges if immediate patching is delayed.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-90797?

The CVSS 4.0 score for this vulnerability is 7.7, which is classified as high severity.

Which Apache CouchDB versions are vulnerable?

All versions of Apache CouchDB before 3.5.3 are affected by this vulnerability.

Is authentication required to exploit this flaw?

No, the advisory states that the vulnerability allows pre-authentication exploitation by any remote client.