Apache Couchdb (Apache Software Foundation) - vulnerabilities (CVEs)
16 CVEs, 6 in the last 30 days, 2 known versions, newest CVE from 2026-10-20. Vendor: Apache Software Foundation.
CVEs of Apache Couchdb
- CVE-2026-107755 - CVSS 6 (medium), 2026-10-20: Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read…
- CVE-2026-90800 - CVSS 8.1 (high), 2026-10-20: Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or…
- CVE-2026-90799 - CVSS 1.3 (low), 2026-10-20: Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via…
- CVE-2026-90798 - CVSS 0.6 (low), 2026-10-20: A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a…
- CVE-2026-90797 - CVSS 7.7 (high), 2026-10-20: An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via…
- CVE-2026-86471 - CVSS 9.3 (critical), 2026-10-20: An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as…
- CVE-2023-45725 - CVSS 5.7 (medium), 2023-12-13: Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.…
- CVE-2023-26268 - CVSS 5.3 (medium), 2023-05-02: Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document…
- CVE-2022-24706 - CVSS 9.8 (critical), 2022-04-26: In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The…
- CVE-2021-38295 - CVSS 7.3 (high), 2021-10-14: In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin…
- CVE-2018-17188 - CVSS 7.2 (high), 2019-01-02: Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where…
- CVE-2018-11769 - CVSS 7.2 (high), 2018-08-08: CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied…
- CVE-2018-8007 - CVSS 7.2 (high), 2018-07-11: Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration…
- CVE-2016-8742 - CVSS 7.8 (high), 2018-02-12: The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file…
- CVE-2017-12635 - CVSS 9.8 (critical), 2017-11-14: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to…
- CVE-2017-12636 - CVSS 7.2 (high), 2017-11-14: CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level…
