EUVD-2026-105158
GHSA-cxg8-w7xq-jwgf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to CouchDB chttpd interface
-
ExploitSend crafted binary deserialisation payload
-
ImpactExhaust server memory causing DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated CouchDB account (PR:L) with the ability to send requests to the chttpd HTTP endpoint, which then processes an unsafe binary deserialisation path to exhaust memory. Limiting factors: a valid login is mandatory (no anonymous/unauthenticated path), impact is confined to availability degradation (memory exhaustion) with automatic recovery (R:A) rather than data loss or code execution, and only Apache CouchDB 3.5.2 and earlier are affected - upgrading to 3.5.3 removes the condition entirely. |
| Impact | This is a genuinely LOW-priority issue, and the signals are internally consistent rather than conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L) scores just 1.3: network-reachable and low-complexity, but it requires an authenticated account (PR:L), has no confidentiality or integrity impact, and only a LOW availability impact (VA:L/SA:L) - i.e. a degraded-but-not-destroyed service. The vector further weakens real risk with E:U (exploit maturity Unproven), R:A (recovery is Automatic), and AU:Y. No EPSS score, no CISA KEV listing, and no public exploit were supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The only mild tension is that the vendor set both VA:L and SA:L (the subsequent-system availability), which is unusual for a self-contained DoS where no downstream system is affected; this does not change the overall LOW verdict. Bottom line: a real but minor availability bug that is a routine-patch item, not an emergency - the high-level 'deserialisation' framing should not be mistaken for a code-execution threat, since impact is memory exhaustion only. |
| Exploit ScenarioDerived | An attacker who already holds valid CouchDB credentials sends a specially crafted binary payload to the chttpd HTTP interface, triggering unsafe deserialisation that allocates excessive memory. Repeated or sufficiently large requests exhaust server memory and degrade or interrupt database availability. No public proof-of-concept is identified in the provided data, and the CVSS marks exploit maturity as Unproven. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Authenticated users can exhaust memory in Apache CouchDB 3.5.2 and earlier through unsafe binary deserialization in the chttpd HTTP layer, causing a low-impact denial of service. The issue requires a valid CouchDB account and affects availability only, with automatic recovery rather than data loss or code execution. It is fixed in CouchDB 3.5.3, and no public exploit was identified at time of analysis.
RemediationAI
Upgrade to Apache CouchDB 3.5.3, the vendor-released patch for this issue; see the advisory at https://lists.apache.org/thread/bqxkm19hw8985t7opz675b29hs1zl4z9. Until upgrade, restrict chttpd HTTP access to trusted authenticated users and enforce strong account controls, because exploitation requires a valid login (PR:L). Monitor CouchDB memory usage and apply request-size and rate limits at a reverse proxy in front of chttpd to blunt memory-exhaustion attempts, accepting that legitimate large requests may be throttled. Avoid exposing chttpd directly to untrusted networks where possible; this reduces attack surface but may require network re-architecture for remote clients.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CouchDB exposes its HTTP API through chttpd, which handles requests from authenticated clients. The flaw is an unsafe binary deserialization path in chttpd that can be driven by crafted request data to allocate excessive memory and degrade availability. No CWE was supplied; the relevant root-cause class is unsafe deserialization/resource exhaustion. The provided CPE cpe:2.3:a:apache_software_foundation:apache_couchdb:*:*:*:*:*:*:*:* is broad, while the vendor description limits impact to versions 3.5.2 and below on all platforms; the independent assessment confirms PR:L, network reachability, and availability-only impact.
Know when Apache Couchdb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/S:N/AU:Y/R:A/V:D/RE:M/U:Amber
Network-reachable chttpd with low complexity but requires a valid account (PR:L); no confidentiality/integrity impact and only partial availability loss from memory exhaustion (A:L).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
1DescriptionCVE.org
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Couchdb
View allArbitrary shell command execution in Apache CouchDB 3.5.2 and earlier on all platforms allows an authenticated CouchDB s
Unauthenticated read access to the complete contents of prefixed system databases is possible in Apache CouchDB 3.5.2 an
Memory-exhaustion denial of service in Apache CouchDB 3.5.2 and earlier allows any unauthenticated remote client to cras
Insufficient filtering in Apache CouchDB's shared _replicator database (3.5.2 and earlier, all platforms) allows any aut
Denial of service in Apache CouchDB 3.5.2 and earlier: the replicator lacks a circuit-breaker on HTTP redirects, so a re
Exploit-DB