2.7. CVE-2014-2668: DoS (CPU and memory consumption) via the count parameter to /_uuids — Apache CouchDB® 3.2 Documentation

# 2.7. CVE-2014-2668: DoS (CPU and memory consumption) via the count parameter to /_uuids

Date: | 26.03.2014
Affected: | Apache CouchDB releases up to and including 1.3.1, 1.4.0, and 1.5.0 are vulnerable.
Severity: | Moderate
Vendor: | The Apache Software Foundation

## 2.7.1. Description

The /_uuids resource’s count query parameter is able to take unreasonable huge numeric value which leads to exhaustion of server resources (CPU and memory) and to DoS as the result.

## 2.7.2. Mitigation

Upgrade to a supported CouchDB release that includes this fix, such as:

- 1.5.1
- 1.6.0

All listed releases have included a specific fix to

## 2.7.3. Work-Around

Disable the /_uuids handler completely, by adapting local.ini and restarting CouchDB:

    [httpd_global_handlers]
    _uuids =