# 2.7. CVE-2014-2668: DoS (CPU and memory consumption) via the count parameter to /_uuids

Date:

  26.03.2014

Affected:

  Apache CouchDB releases up to and including 1.3.1, 1.4.0, and 1.5.0 are vulnerable.

Severity:

  Moderate

Vendor:

  The Apache Software Foundation

## 2.7.1. Description

The /_uuids resource’s count query parameter is able to take unreasonable huge numeric value which leads to exhaustion of server resources (CPU and memory) and to DoS as the result.

## 2.7.2. Mitigation

Upgrade to a supported CouchDB release that includes this fix, such as:

- 1.5.1

- 1.6.0

All listed releases have included a specific fix to

## 2.7.3. Work-Around

Disable the /_uuids handler completely, by adapting local.ini and restarting CouchDB:

    [httpd_global_handlers]
    _uuids =