CVE-2026-90798CWE-834

CVE-2026-90798

published October 20, 2026

CVSS
0.6
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

The record
Technical detail
CVSS
0.6 · NONE
CVSS v4.0
0.6 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
EPSS
0.00596 · 47.8th percentile
Weakness
CWE-834 · Excessive Iteration
Published
2026-10-20T20:17Z
References (3)
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f · [email protected]https://lists.apache.org/thread/m6d526fj57pvq5pswm2lp1shbdz3f417 · [email protected]http://www.openwall.com/lists/oss-security/2026/10/20/13 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 1%
    epss
  • 20 OCT 15:39Z
    Apache CouchDB: Replicator follows redirects indefinitely
    cvelistv5
  • 20 OCT 15:39Z
    Apache CouchDB: Replicator follows redirects indefinitely
    cvelistv5