Not rated Exploited

CVE-2022-24706 Apache CouchDB Insecure Default Initialization of Resource Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-1188

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Affected products and versions

Product	Affected versions	Fixed in
Apache CouchDB 3.2	earliest → 3.2.1	No fix stated

References

lists.apache.org lists.apache.org
docs.couchdb.org docs.couchdb.org
[oss-security] 20220426 CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
packetstormsecurity.com packetstormsecurity.com
medium.com medium.com
packetstormsecurity.com packetstormsecurity.com

Timeline

Published April 26, 2022
Added to the KEV catalogue August 25, 2022
Last modified October 21, 2025

The 16 CVEs of Apache CouchDB →

CVE-2026-107755 Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms… 6.0 Medium CVE-2026-90800 Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the… 8.1 High CVE-2026-90799 Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated… 1.3 Low CVE-2026-90798 A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a… 0.6 Low

Track this CVE