Hi all, I just sent this report to the ASF board:
## Description: Apache CouchDB software is a document-oriented database that can be queried and indexed in a MapReduce fashion using JavaScript. CouchDB also offers incremental replication with bi-directional conflict detection and resolution. ## Project Status: Current project status: Ongoing Issues for the board: none ## Membership Data: Apache CouchDB was founded 2008-11-19 (18 years ago) There are currently 74 committers and 18 PMC members in this project. The Committer-to-PMC ratio is roughly 5:2. Community changes, past quarter: - No new PMC members. Last addition was Glynn Bird on 2023-03-14. - No new committers. Last addition was James Coglan on 2026-03-24. ## Project Activity: The project runs as per usual. We released version 3.5.3 mid-october to address a total of six CVEs and related issues that were reported in the NH-summer flurry of reports. Coordination was a bit tedious given the modern nature of reports including duplicates. We’d like to highlight CVE-2026-86471[1] that what we understand to be an actively exploited vulnerability as per the EU Cyber Resilience Act Article 14[2]. - The issue was made public at around July 22nd 2026. - Active exploits were available on GitHub shortly after. - A vendor notified us about this on September 7th 2026. - Notably, 4 days before the CRA reporting requirement went into effect on September 11th. It is our understanding that under the CRA and the ASF as a Software Steward, this issue would be one of the rare instances that would require communication with a CSIRT and ENISA in future. We are highlighting these because this is a rare occasion and we’d like to put on record the occurrence of this rare event. Separately, we note that the issue as far as it concerns CouchDB has not been reported to us or ASF security around the time it was made public but nearly two months later. We are concerned about a repeat of this and the subsequent danger to our downstream users. [1]: https://docs.couchdb.org/en/stable/cve/2026-86471.html [2]: https://s.apache.org/cra-14 ## Community Health: Community engagement is relatively normal. Our metrics might trend down a little because of the security issue discussion, a lot of time was spent in private discussions. — Best Jan
