CVE-2026-90799

Published: Ott 20, 2026 Last Modified: Ott 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 1,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

502

Deserialization of Untrusted Data

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Application Data Unexpected State Dos: Resource Consumption (Cpu) Varies By Context
Applicable Platforms
Languages: Java, Ruby, PHP, Python, JavaScript
Technologies: Not Technology-Specific, ICS/OT, AI/ML
Likelihood of Exploit: Medium
View CWE Details
http://www.openwall.com/lists/oss-security/2026/10/20/14
http://www.openwall.com/lists/oss-security/2026/10/20/14
https://lists.apache.org/thread/bqxkm19hw8985t7opz675b29hs1…
https://lists.apache.org/thread/bqxkm19hw8985t7opz675b29hs1zl4z9
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwh…
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f