Veille CVE

Octobre 2026

6 CVE

Critique 1 Élevée 2 Moyenne 1 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Apache Software Foundation Apache CouchDB » ✕
  1. CVE-2026-90800 8.1 Élevée

    Apache Software Foundation Apache CouchDB

    Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

  2. CVE-2026-90799 1.3 Faible

    Apache Software Foundation Apache CouchDB

    Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

  3. CVE-2026-90798 0.6 Faible

    Apache Software Foundation Apache CouchDB

    A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

  4. CVE-2026-90797 7.7 Élevée

    Apache Software Foundation Apache CouchDB

    An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

  5. CVE-2026-86471 9.3 Critique

    Apache Software Foundation Apache CouchDB

    An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

  6. CVE-2026-107755 6.0 Moyenne

    Apache Software Foundation Apache CouchDB

    Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this issue.