Apache CouchDB versions 3.5.2 and earlier contain a vulnerability in the replicator component where it follows HTTP redirects indefinitely due to a missing circuit-breaker. This flaw allows the owner of a replication source or target to cause a denial of service by creating an infinite HTTP redirect loop. The issue is fixed in version 3.5.3.