ON 21 October 2026, Apache disclosed six vulnerabilities in Apache CouchDB, led by a critical CVSS 9.3 flaw that could allow an admin to run arbitrary shell commands as the CouchDB operating system user (CVE-2026-86471). Other CouchDB issues include an 8.1-auth bypass in prefixed _users and _replicator databases (CVE-2026-90800) and a pre-authentication gzip decompression bomb via POST /_session (CVE-2026-90797, 7.7).
Two additional low- to moderate-severity weaknesses enable memory exhaustion or credential exposure, including CVE-2026-107755 (6.0) which could let users read other users’ replication credentials, and CVE-2026-90799/90798 describing atom-table exhaustion and infinite redirect-following in replication workflows. CouchDB 3.5.3 addresses these six flaws; none have been confirmed exploited in the wild to date.
ZeroVuln Labs and researchers such as Qing Xu, Piotr Karwasz and Sakil Ahamed Gayen contributed to reporting three CouchDB flaws, with CISA listing exploitation as “none” for these issues.
Separately, the retired Apache Cocoon framework is cited as having four unpatched flaws, with the most severe CVE-2026-108089 (CVSS 7.5) exposing diagnostic interfaces and debug logs to unauthenticated users. The remaining Cocoon flaws include potential SQL injection, inter-user cache leaks, and XML entity expansion risks that could lead to SSRF. Affected versions are Apache CouchDB 3.5.2 and earlier, and all Apache Cocoon versions.
The recommended response is to upgrade to Apache CouchDB 3.5.3, strengthen admin credentials, and replace Cocoon or restrict access to trusted users only. Apache notes that because Cocoon is retired, no future patch will be issued.