ACTIVELY EXPLOITED
CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerability
| Vendor | Apache |
|---|---|
| Product | CouchDB |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Aug 2022 |
| CISA federal deadline | 15 Sep 2022 |
| Weakness (CWE) | CWE-1188 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
SOURCES
Other Apache flaws
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.