Apache CouchDB CVE-2026-90797

No special conditions - remote unauthenticated exploitation against default configurations of Apache CouchDB 3.5.2 and earlier, where the chttpd HTTP interface accepts gzip-encoded request bodies and decompresses them without a size limit. The only practical prerequisite is network reachability of the CouchDB HTTP port (typically 5984/6984); the attacker needs no account, no privileges, and no victim interaction. Limiting factors are deployment-dependent rather than configuration-dependent: instances behind a reverse proxy or WAF that caps request/decompressed body size, or not exposed to untrusted networks, substantially reduce real-world exposure. Impact is limited to availability (service crash/hang via memory exhaustion); no data disclosure or modification results.

This is a genuine but bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction, and the impact is strictly availability (VA:H, VC:N/VI:N) - a classic decompression-bomb denial of service, not code execution or data compromise. Supplemental metrics reinforce the picture: AU:Y (automatable) means the attack can be scripted and repeated cheaply, while E:U (Exploit Maturity: Unreported) indicates no known exploitation or public POC at the time the vendor scored it, consistent with the absence of any CISA KEV listing or POC reference in the provided data. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. The net reading: this is a legitimate patch-worthy issue (easy to trigger, automatable, no auth) but it is a service-crash DoS rather than a system-compromise flaw, so it should be prioritized according to how exposed and business-critical each CouchDB instance is rather than treated as a critical breach vector. No signals conflict; the main gap is the missing EPSS value and the lack of independent POC/exploitation telemetry.

A remote attacker with network access to a CouchDB node's HTTP (chttpd) interface sends a small gzip-compressed request body crafted to decompress to a very large size (a 'zip bomb'). Because decompression is unbounded, the server allocates memory until it is exhausted, crashing or hanging the database and denying service to legitimate clients. No authentication or user interaction is required, and the request is trivially repeatable; no public exploit code is identified at time of analysis.