The vulnerability is an unsafe binary deserialization in the chttpd component of Apache CouchDB versions 3.5.2 and earlier. It allows an authenticated user to send specially crafted sequence values that cause the server to allocate large memory fragments, eventually exhausting available memory and resulting in a denial of service. The weakness is a deserialization flaw that can be triggered by valid API requests.

Affected are installations of Apache CouchDB 3.5.2 and older on all platforms. The attack requires authentication, so any user with a valid CouchDB account can exploit the issue. Versions newer than 3.5.3 are not affected.

The CVSS score is 1.3, reflecting a low severity and no public exploit evidence. EPSS is not available and the vulnerability is not included in CISA’s KEV catalog. Attackers would need to authenticate and submit crafted requests; thus the risk is limited to systems where untrusted users can gain access to the API.