2.21. CVE-2026-90799: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

Date:

12.10.2026

Affected:

3.5.2 and below

Severity:

High

Vendor:

The Apache Software Foundation

2.21.1. Description

CouchDB makes opaque byte sequences available to clients to be passed back for resuming operations. These byte sequences are translated into Erlang terms. As long as only terms are supplied that have been emitted by CouchDB, no problems occur. But since clients can construct their own byte sequences, CouchDB can be tricked into allocating Erlang atom data types until the internal atom table capacity is exhausted. This causes the Erlang VM BEAM to hard abort, causing a denial of service.

2.21.2. Mitigation

CouchDB is now safely parsing byte sequences in a way that does not create new atoms.

2.21.3. Workarounds

N/A

2.21.4. Credit

Piotr Karwasz & ZeroVuln Labs reported this issue independently.