A missing circuit‑breaker in the CouchDB replicator component allows an attacker who owns or can modify the replication source or target to create an endless HTTP redirect loop. The loop exhausts server resources and blocks normal replication traffic, resulting in a denial of service for the affected database instance while leaving confidentiality and integrity unchanged.

Apache CouchDB 3.5.2 and earlier on all supported platforms are affected. The issue is triggered during replication operations on CouchDB instances that allow the replication source or target owner to configure or alter replication settings.

The CVSS score of 0.6 indicates low severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available. The likely attack vector requires an attacker to create or modify a replication configuration, which may be limited to trusted actors or compromised insiders. Once the replication request is sent, the missing circuit breaker causes the CouchDB replicator to continually issue redirects until internal limits are reached or the replication times out, providing a local denial of service only for replication traffic. The overall risk remains modest but remediation is advised due to the impact on service availability.