CVE-2026-90799CWE-502insecure-deserialization

CVE-2026-90799

published October 20, 2026

CVSS
1.3
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

The record
Technical detail
CVSS
1.3 · NONE
CVSS v4.0
1.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/S:N/AU:Y/R:A/V:D/RE:M/U:Amber
EPSS
0.00643 · 50.2th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-10-20T20:17Z
References (3)
http://www.openwall.com/lists/oss-security/2026/10/20/14 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f · [email protected]https://lists.apache.org/thread/bqxkm19hw8985t7opz675b29hs1zl4z9 · [email protected]
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 1%
    epss
  • 20 OCT 15:40Z
    Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
    cvelistv5
  • 20 OCT 15:40Z
    Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
    cvelistv5