Apache CouchDB Replicator Infinite Redirect Loop Causes Denial of Service

Apache CouchDB users face a denial-of-service risk when the replicator component encounters an infinite HTTP redirect loop. This issue, tracked as CVE-2026-90798, stems from a missing circuit-breaker mechanism in the software. According to the official advisory on the oss-security mailing list, the flaw exists in versions prior to 3.5.3 across all supported platforms. An attacker who controls either the source or target of a replication job can exploit this gap to exhaust resources.

Root cause

The underlying issue is the absence of a circuit-breaker within the replicator module of Apache CouchDB 3.5.2 and earlier releases. Without this safeguard, the replicator continues to follow HTTP redirects indefinitely when encountering a loop. Jan Lehnardt posted the advisory on October 20, identifying this lack of termination logic as the primary vulnerability. The system does not stop the request chain, allowing the loop to persist and consume processing capacity until the service becomes unresponsive.

Attack path

Exploitation requires an attacker to own or control either the replication source or the replication target. By configuring a redirect loop between these endpoints, the attacker triggers the replicator to follow the chain without limit. This action does not require high privileges; the CVSS vector indicates low privilege requirements. The continuous redirection prevents the replicator from completing its task, effectively halting replication services and causing a denial of service for the affected CouchDB instance.

Affected versions

• Apache CouchDB versions before 3.5.3 are vulnerable to this redirect loop issue.
• The flaw is present in all platforms running these affected versions.
• Apache CouchDB 3.5.3 and later versions have addressed this specific vulnerability.

Mitigation

• Upgrade Apache CouchDB to version 3.5.3 or newer to resolve the issue.
• Review replication configurations to ensure source and target endpoints are trusted.
• Monitor replicator logs for unusual redirect patterns or high latency.
• Implement network controls to restrict replication traffic to authorized servers.

Signals worth monitoring

Teams should watch for replication jobs that stall or consume excessive CPU resources without progress. Log entries showing repeated HTTP redirect responses between the same endpoints indicate a potential loop. Monitor for sudden spikes in network traffic associated with replicator processes. Check for increased error rates or timeouts in replication tasks.

Verify that replication targets are not returning unexpected redirect codes. Look for patterns where a single replication job generates continuous requests without completing. Investigate any replication source or target that has changed ownership recently. Ensure monitoring alerts trigger on abnormal redirect chains rather than individual failed requests.

What to do and how to stay safe: Apache CouchDB

• Verify your Apache CouchDB version and update to 3.5.3 if you are running an earlier release.
• Audit existing replication configurations to confirm that source and target endpoints are controlled by trusted entities.
• Review system logs for signs of infinite redirect loops or unusual replicator behavior.
• Implement network segmentation to limit replication traffic to designated servers and reduce exposure.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-90798?

The vulnerability is rated as moderate severity with a CVSS score of 4.0.

Which versions of Apache CouchDB are affected?

All versions of Apache CouchDB prior to 3.5.3 are affected by this issue.

Is there a fix available for this vulnerability?

Yes, users are recommended to upgrade to Apache CouchDB 3.5.3 or later.