Advisories · Technology

Apache Software Foundation Apache CouchDB.

Every CVE that names Apache Software Foundation Apache CouchDB among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-107755 CVE record

CVSS 6.0 Medium

Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
- Apache Software Foundation Apache CouchDB
- Information disclosure
Not analysed yet 20 Oct 2026
CVE-2026-90800 CVE record

CVSS 8.1 High

Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
- Apache Software Foundation Apache CouchDB
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-90799 CVE record

CVSS 1.3 Low

Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
- Apache Software Foundation Apache CouchDB
- Insecure deserialization
Not analysed yet 20 Oct 2026
CVE-2026-90798 CVE record

CVSS 0.6 Low

Apache CouchDB: Replicator follows redirects indefinitely
- Apache Software Foundation Apache CouchDB
- Denial of service
Not analysed yet 20 Oct 2026
CVE-2026-90797 CVE record

CVSS 7.7 High

Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
- Apache Software Foundation Apache CouchDB
- CWE-409
Not analysed yet 20 Oct 2026
CVE-2026-86471 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Apache CouchDB: Admin credentials leading to code execution as operating system user
- Apache Software Foundation Apache CouchDB
- Command injection
Not analysed yet 20 Oct 2026
CVE-2023-45725 CVE record

Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents
- Apache Software Foundation Apache CouchDB
- Apache Software Foundation IBM Cloudant
- Information disclosure
Not analysed yet 13 Dec 2023
CVE-2023-26268 CVE record

CVSS 4.4 Medium

Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes
- Apache Software Foundation Apache CouchDB
- Apache Software Foundation IBM Cloudant
- Information disclosure
Not analysed yet 2 May 2023
CVE-2022-24706 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Remote Code Execution Vulnerability in Packaging
- Apache Software Foundation Apache CouchDB
- CWE-1188
Not analysed yet 26 Apr 2022
CVE-2021-38295 CVE record

Privilege escalation vulnerability when using HTML attachments
- Apache Software Foundation Apache CouchDB
- Apache Software Foundation IBM Cloudant
Not analysed yet 14 Oct 2021
CVE-2018-17188 CVE record

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database.
- Apache Software Foundation Apache CouchDB
Not analysed yet 2 Jan 2019
CVE-2018-11769 CVE record

CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S).
- Apache Software Foundation Apache CouchDB
Not analysed yet 8 Aug 2018
CVE-2018-8007 CVE record

Apache CouchDB administrative users can configure the database server via HTTP(S).
- Apache Software Foundation Apache CouchDB
Not analysed yet 11 Jul 2018
CVE-2016-8742 CVE record

Apache Software Foundation Apache CouchDB: The Windows installer that the Apache CouchDB team provides was vulnerable to local…
- Apache Software Foundation Apache CouchDB
Not analysed yet 12 Feb 2018
CVE-2017-12636 CVE record

CouchDB administrative users can configure the database server via HTTP(S).
- Apache Software Foundation Apache CouchDB
Not analysed yet 14 Nov 2017
CVE-2017-12635 CVE record

Apache Software Foundation Apache CouchDB: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser…
- Apache Software Foundation Apache CouchDB
Not analysed yet 14 Nov 2017