AC
Product
Apache CouchDB
On CISA KEVExploited in the wild
8
CVEs
1
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 2High 3Medium 1Low 2
Watch
Add Apache CouchDB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-24706 In wildKEV | 9.8 | Apr 26 | Remote Code Execution Vulnerability in Packaging Affected: Apache CouchDB through 3.2.1 |
| CVE-2026-86471 | 9.3 | Oct 20 | Apache CouchDB: Admin credentials leading to code execution as operating system user Affected: before 3.5.3 |
| CVE-2026-90800 | 8.1 | Oct 20 | Apache CouchDB: Auth bypass in prefixed _users and _replicator databases Affected: before 3.5.3 |
| CVE-2026-90797 | 7.7 | Oct 20 | Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session Affected: before 3.5.3 |
| CVE-2018-11769 | 7.2 | Aug 8 | CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S) Affected: Apache Tomcat 1.x and =2.1.2 |
| CVE-2026-107755 | 6.0 | Oct 20 | Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs Affected: before 3.5.3 |
| CVE-2026-90799 | 1.3 | Oct 20 | Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values Affected: before 3.5.3 |
| CVE-2026-90798 | 0.6 | Oct 20 | Apache CouchDB: Replicator follows redirects indefinitely Affected: before 3.5.3 |
Showing 8