CVE-2026-90797 and CVE-2026-107755 affect Apache CouchDB versions before 3.5.3.
One allows a pre-authentication denial of service through gzip decompression; the other lets an authenticated user read other users' replication credentials.
The Apache Software Foundation fixed both in CouchDB 3.5.3. No exploitation is confirmed.
seclists.orgoss-sec: CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session