Hi all,
I just sent this report to the ASF board:
## Description:
Apache CouchDB software is a document-oriented database that can be queried and
indexed in a MapReduce fashion using JavaScript. CouchDB also offers
incremental replication with bi-directional conflict detection and resolution.
## Project Status:
Current project status: Ongoing
Issues for the board: none
## Membership Data:
Apache CouchDB was founded 2008-11-19 (18 years ago)
There are currently 74 committers and 18 PMC members in this project.
The Committer-to-PMC ratio is roughly 5:2.
Community changes, past quarter:
- No new PMC members. Last addition was Glynn Bird on 2023-03-14.
- No new committers. Last addition was James Coglan on 2026-03-24.
## Project Activity:
The project runs as per usual. We released version 3.5.3 mid-october to address
a total of six CVEs and related issues that were reported in the NH-summer
flurry of reports. Coordination was a bit tedious given the modern nature of
reports including duplicates.
We’d like to highlight CVE-2026-86471[1] that what we understand to be an
actively exploited vulnerability as per the EU Cyber Resilience Act
Article 14[2].
- The issue was made public at around July 22nd 2026.
- Active exploits were available on GitHub shortly after.
- A vendor notified us about this on September 7th 2026.
- Notably, 4 days before the CRA reporting requirement went into effect on
September 11th.
It is our understanding that under the CRA and the ASF as a Software Steward,
this issue would be one of the rare instances that would require communication
with a CSIRT and ENISA in future.
We are highlighting these because this is a rare occasion and we’d like to
put on record the occurrence of this rare event.
Separately, we note that the issue as far as it concerns CouchDB has not been
reported to us or ASF security around the time it was made public but nearly
two months later. We are concerned about a repeat of this and the subsequent
danger to our downstream users.
[1]: https://docs.couchdb.org/en/stable/cve/2026-86471.html
[2]: https://s.apache.org/cra-14
## Community Health:
Community engagement is relatively normal. Our metrics might trend down a
little because of the security issue discussion, a lot of time was spent
in private discussions.
—
Best
Jan
