What’s Vulnerable › Products

Apache Software Foundation Apache CouchDB vulnerabilities

26 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Apache Software Foundation Apache CouchDB version is affected

Exploited Apache Software Foundation Apache CouchDB vulnerabilities

CVE-2022-24706 — Apache CouchDB Insecure Default Initialization of Resource Vulnerability

Latest Apache Software Foundation Apache CouchDB vulnerabilities

CVE-2026-90800 — Apache CouchDB: Auth bypass in prefixed _users and _replicator databases (CVSS 8.1)
CVE-2026-90799 — Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values (CVSS 1.3)
CVE-2026-90798 — Apache CouchDB: Replicator follows redirects indefinitely (CVSS 0.6)
CVE-2026-90797 — Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session (CVSS 7.7)
CVE-2026-86471 — Apache CouchDB: Admin credentials leading to code execution as operating system user (CVSS 9.3)
CVE-2026-107755 — Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs (CVSS 6.0)
CVE-2023-45725 — Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents (CVSS 5.7)
CVE-2023-26268 — Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes (CVSS 5.3)
CVE-2022-24706 — Apache CouchDB Insecure Default Initialization of Resource Vulnerability (CVSS 9.8) — exploited
CVE-2021-38295 — Privilege escalation vulnerability when using HTML attachments (CVSS 7.3)
CVE-2020-1955 — (CVSS 9.8)
CVE-2018-17188 — (CVSS 7.2)
CVE-2018-14889 — (CVSS 7.8)
CVE-2018-11769 — (CVSS 7.2)
CVE-2018-8007 — (CVSS 7.2)
CVE-2016-8742 — (CVSS 7.8)
CVE-2017-12636 — (CVSS 7.2)
CVE-2017-12635 — (CVSS 9.8)
CVE-2012-5649 — (CVSS 6.8)
CVE-2014-2668 — (CVSS 5.0)
CVE-2012-5650 — (CVSS 4.3)
CVE-2012-5641 — (CVSS 5.0)
CVE-2010-3854 — (CVSS 4.3)
CVE-2010-2953 — (CVSS 6.9)
CVE-2010-2234 — (CVSS 6.8)