Skip to content
fr Sign in
4.4 Medium

CVE-2023-26268 Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript…

Description

Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as filters) * rewrite * update This doesn't affect map/reduce or search (Dreyfus) index functions. Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3). Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.

Affected products and versions

Product Affected versions Fixed in
Apache CouchDB 3.3 earliest → 3.3.1 No fix stated
IBM Cloudant 8349 earliest → 8349 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache CouchDB

The 16 CVEs of Apache CouchDB →
CVE-2026-107755 Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms… 6.0 Medium CVE-2026-90800 Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the… 8.1 High CVE-2026-90799 Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated… 1.3 Low CVE-2026-90798 A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a… 0.6 Low
Track this CVE