CVE-2026-90799 in CouchDB
Summary
by MITRE • 10/20/2026
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified involves unsafe binary deserialization within the chttpd component of Apache CouchDB versions 3.5.2 and earlier across all supported platforms. This flaw permits an authenticated user to trigger a denial of service condition by inducing memory exhaustion on the target system. The root cause lies in how the server processes incoming data structures that are serialized using binary formats, specifically failing to adequately validate or limit the complexity and size of these objects before instantiation. When such maliciously crafted payloads are received, the deserialization process allocates excessive amounts of heap memory without appropriate bounds checking, leading to resource depletion.
From a technical perspective, this issue aligns with CWE-502, which describes Deserialization of Untrusted Data. The vulnerability arises because the application trusts input from authenticated users too implicitly during the parsing phase. While authentication provides some level of trust regarding identity, it does not guarantee that the data being processed is safe or well-formed. In many cases, attackers can exploit this by sending deeply nested objects, large arrays, or circular references that cause the Java Virtual Machine or underlying runtime environment to consume memory rapidly until the system becomes unresponsive or crashes due to out-of-memory errors. This behavior is characteristic of insecure deserialization flaws where the application fails to restrict the types and sizes of data it processes during reconstruction from serialized formats.
The operational impact of this vulnerability is primarily a denial of service against CouchDB instances running affected versions. Since the attack requires authentication, the scope is limited to users who have valid credentials on the target system. However, even with restricted access levels, an attacker can disrupt availability by exhausting server resources. This disruption affects not only the targeted database instance but potentially other services relying on it if they share underlying infrastructure or connection pools. The lack of rate limiting or size constraints in the deserialization logic makes this vulnerability particularly dangerous for environments where internal users might be compromised or malicious insiders exist within the organization.
To mitigate this risk, organizations should upgrade Apache CouchDB to version 3.5.3 or later as soon as possible. This release includes patches that address the unsafe handling of binary data during deserialization processes. In addition to upgrading, administrators should enforce strict access controls and monitor for unusual spikes in memory usage associated with database operations. Implementing network-level protections such as Web Application Firewalls can also help detect anomalous request patterns indicative of exploitation attempts. Furthermore, adopting secure coding practices that validate input size and structure before deserialization is critical for preventing similar vulnerabilities in future development cycles.
This incident highlights the importance of treating all data inputs with skepticism regardless of their source authentication status. Security teams should review existing applications for similar patterns where untrusted or partially trusted data undergoes complex transformation processes without adequate safeguards. Regular security assessments focusing on input validation and resource management will help identify such weaknesses before they can be exploited in production environments. By adhering to these recommendations, organizations can maintain the integrity and availability of their CouchDB deployments while minimizing exposure to deserialization-based attacks.