2.19. CVE-2026-90797: Pre-authentication gzip decompression bomb via POST /_session

Date:

12.10.2026

Affected:

3.5.2 and below

Severity:

High

Vendor:

The Apache Software Foundation

2.19.1. Description

CouchDB allows for gzip compressed request bodies to unauthenticated endpoints like /_session. Only the compressed input is subject to request body limitations. This allows highly compressed gzip streams to produce out of memory scenarios for CouchDB’s beam.smp process.

2.19.2. Mitigation

HTTP request body decompression now happens in chunks and at each iteration, the uncompressed output length is subject to the request body limit.

2.19.3. Workarounds

N/A

2.19.4. Credit

ZeroVuln labs