Apache CouchDB versions 3.5.2 and earlier contain a vulnerability in the chttpd component where an unlimited gzip decompression routine can be triggered by any remote client via a POST request to /_session. This flaw allows denial of service through memory exhaustion. The issue is fixed in version 3.5.3.