AC
Product
Apache CouchDB
On CISA KEVExploited in the wild
8
CVEs
1
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 2High 3Medium 1Low 2
Watch
Add Apache CouchDB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-90800 | 8.1 | Oct 20 | Apache CouchDB: Auth bypass in prefixed _users and _replicator databases Affected: before 3.5.3 |
| CVE-2026-90797 | 7.7 | Oct 20 | Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session Affected: before 3.5.3 |
| CVE-2018-11769 | 7.2 | Aug 8 | CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S) Affected: Apache Tomcat 1.x and =2.1.2 |
Showing 3