Apache Couchdb
Monthly
Unauthenticated read access to the complete contents of prefixed system databases is possible in Apache CouchDB 3.5.2 and earlier because chttpd fails to enforce authorization on an API endpoint that serves those databases. Only deployments that have renamed their system databases with a prefix (a configuration the vendor calls 'very rare') are exposed - instances using the default _users and _replicator names are not exploitable - but where that condition holds, a remote attacker with network reach to the HTTP API can dump user credential documents or replication definitions without credentials or user interaction. Our assessment rates confidentiality impact as high with no integrity or availability effect, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Memory-exhaustion denial of service in Apache CouchDB 3.5.2 and earlier allows any unauthenticated remote client to crash or hang the database by submitting a gzip-encoded HTTP request body that chttpd decompresses without any upper size bound. Impact is limited to availability - no data disclosure or modification - and the only practical prerequisite is network reachability of the CouchDB HTTP interface (typically 5984/6984), with no account, privileges, or victim interaction required. No public exploit code or confirmed active exploitation was identified at time of analysis; Apache has released CouchDB 3.5.3 to fix the issue, and instances sitting behind a proxy or WAF that caps request body size are substantially less exposed.
Arbitrary shell command execution in Apache CouchDB 3.5.2 and earlier on all platforms allows an authenticated CouchDB server administrator to run commands as the CouchDB operating-system user by setting an unvalidated runtime configuration value. The flaw crosses from application administration into host command execution, so the main risk is privilege escalation from CouchDB admin to the underlying host or misuse of stolen admin credentials; exploitation requires high-privilege authentication (PR:H) and is not remote-unauthenticated. Vendor-released patch: 3.5.3; no public exploit identified at time of analysis.
Insufficient filtering in Apache CouchDB's shared _replicator database (3.5.2 and earlier, all platforms) allows any authenticated user to read the replication credentials belonging to other users' replication jobs, potentially exposing usernames, passwords, or auth tokens for external source and target endpoints. The flaw is only meaningful in multi-user or multi-tenant deployments where distinct users' credential-bearing replications coexist; a low-privileged account with no user interaction and no admin rights can harvest those secrets and pivot to the systems they unlock, which is why the vendor's CVSS 4.0 vector rates subsequent-system confidentiality as high. Upgrading to 3.5.3 fixes the issue; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated users can exhaust memory in Apache CouchDB 3.5.2 and earlier through unsafe binary deserialization in the chttpd HTTP layer, causing a low-impact denial of service. The issue requires a valid CouchDB account and affects availability only, with automatic recovery rather than data loss or code execution. It is fixed in CouchDB 3.5.3, and no public exploit was identified at time of analysis.
Denial of service in Apache CouchDB 3.5.2 and earlier: the replicator lacks a circuit-breaker on HTTP redirects, so a replication endpoint that returns an endless redirect chain keeps the replicator chasing it indefinitely and degrades availability of the replication subsystem. The attacker must be an authenticated owner of a replication source or target (PR:L) and must control that endpoint's HTTP responses, so this is not reachable by an unauthenticated outsider and affects only availability, not confidentiality or integrity. Scoring is low (independent assessment: CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L; vendor CVSS 4.0 base 0.6), and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a low-priority issue despite being network-reachable.
Unauthenticated read access to the complete contents of prefixed system databases is possible in Apache CouchDB 3.5.2 and earlier because chttpd fails to enforce authorization on an API endpoint that serves those databases. Only deployments that have renamed their system databases with a prefix (a configuration the vendor calls 'very rare') are exposed - instances using the default _users and _replicator names are not exploitable - but where that condition holds, a remote attacker with network reach to the HTTP API can dump user credential documents or replication definitions without credentials or user interaction. Our assessment rates confidentiality impact as high with no integrity or availability effect, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Memory-exhaustion denial of service in Apache CouchDB 3.5.2 and earlier allows any unauthenticated remote client to crash or hang the database by submitting a gzip-encoded HTTP request body that chttpd decompresses without any upper size bound. Impact is limited to availability - no data disclosure or modification - and the only practical prerequisite is network reachability of the CouchDB HTTP interface (typically 5984/6984), with no account, privileges, or victim interaction required. No public exploit code or confirmed active exploitation was identified at time of analysis; Apache has released CouchDB 3.5.3 to fix the issue, and instances sitting behind a proxy or WAF that caps request body size are substantially less exposed.
Arbitrary shell command execution in Apache CouchDB 3.5.2 and earlier on all platforms allows an authenticated CouchDB server administrator to run commands as the CouchDB operating-system user by setting an unvalidated runtime configuration value. The flaw crosses from application administration into host command execution, so the main risk is privilege escalation from CouchDB admin to the underlying host or misuse of stolen admin credentials; exploitation requires high-privilege authentication (PR:H) and is not remote-unauthenticated. Vendor-released patch: 3.5.3; no public exploit identified at time of analysis.
Insufficient filtering in Apache CouchDB's shared _replicator database (3.5.2 and earlier, all platforms) allows any authenticated user to read the replication credentials belonging to other users' replication jobs, potentially exposing usernames, passwords, or auth tokens for external source and target endpoints. The flaw is only meaningful in multi-user or multi-tenant deployments where distinct users' credential-bearing replications coexist; a low-privileged account with no user interaction and no admin rights can harvest those secrets and pivot to the systems they unlock, which is why the vendor's CVSS 4.0 vector rates subsequent-system confidentiality as high. Upgrading to 3.5.3 fixes the issue; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated users can exhaust memory in Apache CouchDB 3.5.2 and earlier through unsafe binary deserialization in the chttpd HTTP layer, causing a low-impact denial of service. The issue requires a valid CouchDB account and affects availability only, with automatic recovery rather than data loss or code execution. It is fixed in CouchDB 3.5.3, and no public exploit was identified at time of analysis.
Denial of service in Apache CouchDB 3.5.2 and earlier: the replicator lacks a circuit-breaker on HTTP redirects, so a replication endpoint that returns an endless redirect chain keeps the replicator chasing it indefinitely and degrades availability of the replication subsystem. The attacker must be an authenticated owner of a replication source or target (PR:L) and must control that endpoint's HTTP responses, so this is not reachable by an unauthenticated outsider and affects only availability, not confidentiality or integrity. Scoring is low (independent assessment: CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L; vendor CVSS 4.0 base 0.6), and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a low-priority issue despite being network-reachable.