CVE-2026-90798

Published: Oct 20, 2026Modified: Oct 20, 2026Deferred

0.6

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:AmberShow less

Source: security@apache.org (Secondary)

Description

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Related CWEs

CWE-834

Excessive Iteration

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

References (3)

https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f

Source: security@apache.org

https://lists.apache.org/thread/m6d526fj57pvq5pswm2lp1shbdz3f417

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/10/20/13

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.