Apache CouchDB 3.5.3 Fixes Six Flaws as Retired Apache Cocoon Gets Four Unpatched Bugs
Do Son 
TL;DR
On October 20, 2026, Apache disclosed six Apache CouchDB vulnerabilities, led by a CVSS 9.3 command execution flaw. CouchDB 3.5.3 fixes all of them. Apache also published four flaws in the retired Apache Cocoon framework, and none will ever be patched.
- Total: 10 CVEs
- Severity: 1 Critical · 3 High · 1 Medium · 2 Low · 3 Unrated
- Actively exploited: None confirmed
- Highest severity: 9.3 (Critical · CVSSv4) — CVE-2026-86471
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-86471 | 9.3 | Admin credentials leading to code execution as operating system user | 3.5.3 | Not exploited |
| CVE-2026-90800 | 8.1 | Auth bypass in prefixed _users and _replicator databases | 3.5.3 | Not exploited |
| CVE-2026-90797 | 7.7 | Pre-authentication gzip decompression bomb via POST /_session | 3.5.3 | Not exploited |
| CVE-2026-108089 | 7.5 | CWE-497 | — | Not exploited |
| CVE-2026-107755 | 6 | Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs | 3.5.3 | Not exploited |
| CVE-2026-90799 | 1.3 | Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values | 3.5.3 | Not exploited |
| CVE-2026-90798 | 0.6 | Replicator follows redirects indefinitely | 3.5.3 | Not exploited |
| CVE-2026-108088 | Awaiting analysis | CWE-524 | — | Not exploited |
Why It Matters
CouchDB stores data for many web and mobile apps. Several of these bugs need no login at all. Meanwhile, Cocoon still runs inside some legacy Java systems, so its flaws stay open for good. Apache states plainly: “As this project is retired, we do not plan to release a version that fixes this issue.”
How the Attacks Work
Apache CouchDB vulnerabilities
- CVE-2026-86471 (CVSS 9.3): a CouchDB admin can “run arbitrary shell commands as the CouchDB operating system user.”
- CVE-2026-90800 (8.1): missing checks let “any request” read prefixed _users or _replicator databases. Apache notes such setups are “very rare.”
- CVE-2026-90797 (7.7): any remote client can exhaust memory with a gzip bomb, no login needed.
- CVE-2026-107755 (6.0): users can read other users’ replication credentials.
- Two low-severity flaws allow denial of service through memory exhaustion or redirect loops.
ZeroVuln Labs reported or co-reported three of the CouchDB flaws, alongside researchers Qing Xu, Piotr Karwasz and Sakil Ahamed Gayen.
Apache Cocoon flaws
The most severe, CVE-2026-108089 (CVSS 7.5), exposes diagnostic interfaces and debug logs to unauthenticated users. The others allow SQL injection, cache leaks between users, and XML entity expansion that can lead to SSRF.
Exploitation status
No source confirms exploitation in the wild, and CISA lists exploitation as “none.” Notably, Apache’s CVSS data for CVE-2026-86471 marks exploit maturity as “Attacked,” but it shares no further details.
Affected Versions
- Apache CouchDB: 3.5.2 and earlier
- Apache Cocoon: all versions
Patch and Mitigation Steps
- Upgrade to Apache CouchDB 3.5.3.
- Protect CouchDB admin accounts with strong, unique passwords.
- Replace Apache Cocoon, or limit access to trusted users only.
Given the 9.3 score, admins should patch these Apache CouchDB vulnerabilities without delay.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
