# CVE-2026-90798: Apache CouchDB missing circuit-breaker in replicator

Source: https://junglewise.ai/threats/cve-2026-90798-a-missing-circuit-breaker-in-the-replicator-in-apache-couchdb-3-5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-90798 · Severity: info · Published 2026-10-20

Apache CouchDB is a NoSQL database often used for distributed data synchronization. A missing safety check in the replication feature allows an attacker who controls a replication source or target to create infinite redirect loops, causing the database to consume resources and become unavailable for legitimate users.

Technologies: [Apache CouchDB](https://junglewise.ai/threats/technologies/couchdb). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-90798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90798 being exploited in the wild.

**How severe is CVE-2026-90798?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Apache CouchDB 3.5.2 and below.

**Is there a fix for CVE-2026-90798?** Yes: fixed in CouchDB 3.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90798 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90798?** Check whether you run Apache CouchDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CouchDB 3.5.3

## Technical details

The replicator component in CouchDB lacks a circuit-breaker mechanism to detect and stop infinite HTTP redirect loops, allowing an attacker controlling a replication source or target to trigger a denial of service. This is a network-accessible vulnerability requiring the attacker to be the owner of one end of a replication pair. The fix is available in version 3.5.3.

## Affected products

- Apache CouchDB 3.5.2 and below

## Timeline

- 2026-10-20: disclosed

## References

- [https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f](https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f)
- [https://lists.apache.org/thread/m6d526fj57pvq5pswm2lp1shbdz3f417](https://lists.apache.org/thread/m6d526fj57pvq5pswm2lp1shbdz3f417)

## Related threats

- [Apache CouchDB missing authorization checks in chttpd](https://junglewise.ai/threats/cve-2026-90800-missing-authorisation-checks-in-chttpd-in-apache-couchdb-3-5-2)
- [Apache CouchDB unsafe binary deserialisation in chttpd](https://junglewise.ai/threats/cve-2026-90799-unsafe-binary-deserialisation-in-chttpd-in-apache-couchdb-3-5-2)
- [Apache CouchDB unlimited gzip decompression denial of service](https://junglewise.ai/threats/cve-2026-90797-an-unlimited-gzip-decompression-routine-in-chttpd-in-apache)
- [Apache CouchDB arbitrary code execution via unvalidated runtime configuration](https://junglewise.ai/threats/cve-2026-86471-an-unvalidated-runtime-configuration-value-in-apache-couchdb-3-5)
- [Apache CouchDB insufficient credential filtering in _replicator](https://junglewise.ai/threats/cve-2026-107755-insufficient-filtering-of-credentials-in-the-replicator-database)