CVE-2026-90797

Description

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Is your site exposed to CVE-2026-90797?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0067

Probability of exploitation

0.52%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-409 CWE-409

References

Other References

https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f https://lists.apache.org/thread/gsbotof0qn8x6zlpd7t568ny4053jo0n http://www.openwall.com/lists/oss-security/2026/10/20/12

Frequently Asked Questions

What is CVE-2026-90797? +

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

How do I check if I'm vulnerable to CVE-2026-90797? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-66054

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ …

CVE-2026-97334

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance …

CVE-2026-86104

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a …

CVE-2026-118261

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream …

CVE-2026-54556

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an …

CVE-2026-62963

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit …