CVE-2026-90798

Description

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Is your site exposed to CVE-2026-90798?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-834 CWE-834

References

Other References

https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f https://lists.apache.org/thread/m6d526fj57pvq5pswm2lp1shbdz3f417 http://www.openwall.com/lists/oss-security/2026/10/20/13

Frequently Asked Questions

What is CVE-2026-90798? +

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

How do I check if I'm vulnerable to CVE-2026-90798? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-91137

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift …

CVE-2026-53493

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph …

CVE-2026-84311

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes …

CVE-2026-87721

Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review …

CVE-2026-77357

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug …

CVE-2026-59644

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.