An unlimited gzip decompression routine in the chttpd component of Apache CouchDB allows a remote client to submit excessively large compressed data via a POST to /_session before authentication. The server will decompress the data without size bounds, consuming the process memory until exhaustion. This can lead to the CouchDB instance becoming unresponsive or terminating, compromising availability and potentially impacting any services relying on the database.

Apache CouchDB versions 3.5.2 and earlier on all supported platforms are affected. The vulnerability exists in the chttpd process and is present in every build before the 3.5.3 release.

The CVSS score of 7.7 indicates a high risk rating, and the vulnerability allows remote exploitation without any authentication. The EPSS score is reported as not available, so the historical exploitation likelihood is unknown, but the lack of a KEV listing suggests no widely used exploits are documented currently. Attackers can trigger the denial of service by sending large gzip payloads to the session endpoint, potentially from any external source.