The CVE information is now public:
2.18. CVE-2026-86471: Admin credentials leading to code execution as operating system user https://docs.couchdb.org/en/stable/cve/2026-86471.html 2.19. CVE-2026-90797: Pre-authentication gzip decompression bomb via POST /_session https://docs.couchdb.org/en/stable/cve/2026-90797.html 2.20. CVE-2026-90798: Replicator follows redirects indefinitely https://docs.couchdb.org/en/stable/cve/2026-90798.html 2.21. CVE-2026-90799: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values https://docs.couchdb.org/en/stable/cve/2026-90799.html 2.22. CVE-2026-90800: Auth bypass in prefixed Apache CouchDB _users and _replicator databases https://docs.couchdb.org/en/stable/cve/2026-90800.html 2.23. CVE-2026-107755: Credential Disclosure via Object-Form Replication URLs in _replicator https://docs.couchdb.org/en/stable/cve/2026-107755.html Best Jan > On 12. Oct 2026, at 11:23, Jan Lehnardt <[email protected]> wrote: > > Dear community, > > Apache CouchDB® 3.5.3 has been released and is available for download. > > CouchDB 3.5.3 is a maintenance release that includes fixes for several > security vulnerabilities. In this release announcement, we are only > mentioning the CVE ids for users to track. Details for all CVEs will be made > available seven (7) days after this release to give everybody enough time to > upgrade. > > The CouchDB team recommends upgrading to this version in a timely manner. > > It was originally published on 2026-10-12. > > https://couchdb.apache.org/#download > > Pre-built packages for Windows, macOS, Debian/Ubuntu and RHEL/CentOS, as well > as Docker images are available. > > Release Notes highlights: > > - Includes fixes for CVE-2026-86471, CVE-2026-90797, CVE-2026-90798, > CVE-2026-90800, CVE-2026-90799, CVE-2026-107755 > > - Numerous substantial performance improvements. > > - Over 50 bugfixes and improvements across the whole codebase. > > See the official release notes document for an exhaustive list of all changes: > > http://docs.couchdb.org/en/stable/whatsnew/3.5.html > > Apache CouchDB® lets you access your data where you need it. The Couch > Replication Protocol is implemented in a variety of projects and products > that span every imaginable computing environment from globally distributed > server-clusters, over mobile phones to web browsers. > > Store your data safely, on your own servers, or with any leading cloud > provider. Your web- and native applications love CouchDB, because it speaks > JSON natively and supports binary data for all your data storage needs. > > The Couch Replication Protocol lets your data flow seamlessly between server > clusters to mobile phones and web browsers, enabling a compelling > offline-first user-experience while maintaining high performance and strong > reliability. CouchDB comes with a developer-friendly query language, and > optionally MapReduce for simple, efficient, and comprehensive data retrieval. > > The community would like to thank all contributors for their part in making > this release, from the smallest bug report or patch to major contributions in > code, design, or marketing, we couldn’t have done it without you! > > On behalf of the CouchDB PMC, > Jan Lehnardt > — >
