2.20. CVE-2026-90798: Replicator follows redirects indefinitely

Date:

12.10.2026

Affected:

3.5.2 and below

Severity:

Medium

Vendor:

The Apache Software Foundation

2.20.1. Description

The CouchDB replicator follows HTTP redirects indefinitely. This allowed a malicious replication endpoint to cause a denial of service for individual replication jobs.

2.20.2. Mitigation

Existing retry limits are now applied for all replicator requests. After 5 retries the replication job fails with a too_many_redirects error.

2.20.3. Workarounds

N/A

2.20.4. Credit

The CouchDB team discovered this issue while reviewing independent reports from Piotr Karwasz, Sec-Rex & ZeroVuln Labs.