{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Apache Software Foundation Apache CouchDB: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apache-software-foundation--apache-couchdb/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apache-software-foundation--apache-couchdb/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107755/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107755/",
   "title": "CVE-2026-107755 disclosed",
   "content_text": "Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
   "date_published": "2026-10-20T15:41:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-90800/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-90800/",
   "title": "CVE-2026-90800 disclosed",
   "content_text": "Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.\n\n\nThe use of prefixed system databases is very rare.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
   "date_published": "2026-10-20T15:40:47Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-90799/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-90799/",
   "title": "CVE-2026-90799 disclosed",
   "content_text": "Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
   "date_published": "2026-10-20T15:40:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-90798/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-90798/",
   "title": "CVE-2026-90798 disclosed",
   "content_text": "A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
   "date_published": "2026-10-20T15:39:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-90797/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-90797/",
   "title": "CVE-2026-90797 disclosed",
   "content_text": "An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
   "date_published": "2026-10-20T15:39:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86471/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86471/",
   "title": "CVE-2026-86471 disclosed",
   "content_text": "An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
   "date_published": "2026-10-20T15:38:09Z"
  }
 ]
}