bitnami-bot · Oct 28, 2026
diff --git a/data/couchdb/BIT-couchdb-2026-107755.json b/data/couchdb/BIT-couchdb-2026-107755.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.6.2",
+  "id": "BIT-couchdb-2026-107755",
+  "summary": "Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs",
+  "details": "Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
+  "aliases": [
+    "CVE-2026-107755"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "couchdb",
+        "purl": "pkg:bitnami/couchdb"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V4",
+          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.5.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "Medium",
+    "cpes": [
+      "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/10/20/16"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11oqq900n"
+    },
+    {
+      "type": "WEB",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107755"
+    }
+  ],
+  "published": "2026-10-28T08:40:16.859Z",
+  "modified": "2026-10-28T09:14:33.188Z"
+}
diff --git a/data/couchdb/BIT-couchdb-2026-86471.json b/data/couchdb/BIT-couchdb-2026-86471.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.6.2",
+  "id": "BIT-couchdb-2026-86471",
+  "summary": "Apache CouchDB: Admin credentials leading to code execution as operating system user",
+  "details": "An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
+  "aliases": [
+    "CVE-2026-86471"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "couchdb",
+        "purl": "pkg:bitnami/couchdb"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V4",
+          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Red"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.5.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "Critical",
+    "cpes": [
+      "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/10/20/11"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/c8p73gswgogtnzvk7hpw8jb8d4mnosdp"
+    },
+    {
+      "type": "WEB",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86471"
+    }
+  ],
+  "published": "2026-10-28T08:40:18.062Z",
+  "modified": "2026-10-28T09:14:33.188Z"
+}
diff --git a/data/couchdb/BIT-couchdb-2026-90797.json b/data/couchdb/BIT-couchdb-2026-90797.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.6.2",
+  "id": "BIT-couchdb-2026-90797",
+  "summary": "Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session",
+  "details": "An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
+  "aliases": [
+    "CVE-2026-90797"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "couchdb",
+        "purl": "pkg:bitnami/couchdb"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V4",
+          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:M/U:Red"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.5.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "High",
+    "cpes": [
+      "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/10/20/12"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/gsbotof0qn8x6zlpd7t568ny4053jo0n"
+    },
+    {
+      "type": "WEB",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90797"
+    }
+  ],
+  "published": "2026-10-28T08:40:19.364Z",
+  "modified": "2026-10-28T09:14:33.188Z"
+}
diff --git a/data/couchdb/BIT-couchdb-2026-90798.json b/data/couchdb/BIT-couchdb-2026-90798.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.6.2",
+  "id": "BIT-couchdb-2026-90798",
+  "summary": "Apache CouchDB: Replicator follows redirects indefinitely",
+  "details": "A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
+  "aliases": [
+    "CVE-2026-90798"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "couchdb",
+        "purl": "pkg:bitnami/couchdb"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V4",
+          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.5.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "Low",
+    "cpes": [
+      "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/10/20/13"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/m6d526fj57pvq5pswm2lp1shbdz3f417"
+    },
+    {
+      "type": "WEB",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90798"
+    }
+  ],
+  "published": "2026-10-28T08:40:20.590Z",
+  "modified": "2026-10-28T09:14:33.188Z"
+}
diff --git a/data/couchdb/BIT-couchdb-2026-90799.json b/data/couchdb/BIT-couchdb-2026-90799.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.6.2",
+  "id": "BIT-couchdb-2026-90799",
+  "summary": "Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values",
+  "details": "Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
+  "aliases": [
+    "CVE-2026-90799"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "couchdb",
+        "purl": "pkg:bitnami/couchdb"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V4",
+          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:M/U:Amber"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.5.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "Low",
+    "cpes": [
+      "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/10/20/14"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/bqxkm19hw8985t7opz675b29hs1zl4z9"
+    },
+    {
+      "type": "WEB",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90799"
+    }
+  ],
+  "published": "2026-10-28T08:40:21.739Z",
+  "modified": "2026-10-28T09:14:33.188Z"
+}
diff --git a/data/couchdb/BIT-couchdb-2026-90800.json b/data/couchdb/BIT-couchdb-2026-90800.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.6.2",
+  "id": "BIT-couchdb-2026-90800",
+  "summary": "Apache CouchDB: Auth bypass in prefixed _users and _replicator databases",
+  "details": "Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.\n\n\nThe use of prefixed system databases is very rare.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.",
+  "aliases": [
+    "CVE-2026-90800"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "couchdb",
+        "purl": "pkg:bitnami/couchdb"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V4",
+          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.5.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "High",
+    "cpes": [
+      "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/10/20/15"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/vng8vqjwgy1qlrv14wzrgs7pv4gj7gwr"
+    },
+    {
+      "type": "WEB",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90800"
+    }
+  ],
+  "published": "2026-10-28T08:40:23.002Z",
+  "modified": "2026-10-28T09:14:33.188Z"
+}