5984

Port 5984/tcp is registered with IANA as couchdb with the description "CouchDB," assignee and contact Noah Slater, and registration date 2007-11-27 (dual-registered on TCP and UDP with identical values; the IANA reference/RFC field is blank). In practice it is the default HTTP API and administration port for Apache CouchDB, an open-source, HTTP-native NoSQL document database. Clients talk to CouchDB entirely over its RESTful HTTP interface on 5984, using it for reads and writes, administration, and CouchDB's signature multi-master replication/synchronisation between nodes; the TLS variant conventionally lives on 6984/tcp, and older or clustered builds expose a separate node-local admin API on 5986. The port matters to an analyst mainly as an exposure signal: internet-wide scanners such as Shodan trivially enumerate open 5984 by fingerprinting CouchDB's HTTP response, and the Shadowserver Foundation runs a dedicated daily "Accessible CouchDB" report rating exposed instances as HIGH severity (its 2022-07-03 snapshot counted 4,139 unique CouchDB instances reachable on IPv4). The best-known CouchDB security event, CVE-2022-24706 (CVSSv3 9.8), stemmed from a predictable default Erlang cookie ("monster") shipped in the packaging: an attacker able to reach CouchDB's Erlang distribution port could authenticate with the guessable cookie and execute arbitrary Erlang for full RCE. That chain targets the dynamically assigned Erlang distribution port (alongside EPMD on 4369/tcp), not 5984 itself, but instances discovered via an exposed 5984 are the population at risk; it was fixed in CouchDB 3.2.2+ and was actively exploited to deploy Kinsing cryptomining malware shortly after disclosure in 2022.

IANA assignment

couchdb — "CouchDB"; reference (blank — no RFC cited in IANA registry); assignee/contact Noah Slater; registration date 2007-11-27; dual-registered 5984/tcp + 5984/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV lines 10206–10207; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?page=97)

Range class

registered (1024–49151)

Primary use

default HTTP API / administration / replication port for Apache CouchDB (open-source NoSQL document database)

Common software

Apache CouchDB (the dominant software on this port); CouchDB-compatible/derivative stacks (e.g. PouchDB sync targets, embedded local-first data-sync deployments)

Exposure / scanning

routinely enumerated by Shodan (port:5984); Shadowserver "Accessible CouchDB" daily report rates exposure HIGH severity — 4,139 unique exposed IPv4 instances on 2022-07-03; mitigation is simply firewalling the service (no need to internet-face it)

Security implications

CVE-2022-24706 (CVSSv3 9.8, Critical) — predictable default Erlang cookie "monster" → auth to the Erlang distribution port → arbitrary Erlang execution / full RCE; targets the distribution port (not 5984 directly), but 5984-exposed hosts are the at-risk population; fixed in CouchDB 3.2.2+; actively exploited to drop Kinsing malware (~2022-05) [Confirmed/Threat-reported] — https://www.openwall.com/lists/oss-security/2022/04/26/1, https://www.countercraftsec.com/blog/active-exploitation-of-apache-couchdb-cve-2022-24706/

Typically seen on

Apache CouchDB servers and CouchDB-embedding application/IoT stacks; an internet-facing 5984 is usually an unnecessary exposure worth investigating

Related CouchDB ports

6984/tcp (TLS/SSL variant), 5986 (node-local admin API on older/clustered builds), 4369/tcp (EPMD, Erlang port mapper) [Likely] — https://www.verylazytech.com/couchdb-port-5984-6984

Analyst note

An open 5984 almost always means Apache CouchDB. Treat an internet-facing instance as an exposure to triage — confirm auth is enabled, the build is ≥3.2.2, and the Erlang distribution port / 4369 are not also reachable.

Port 5984 is registered with IANA as couchdb with the description "CouchDB," assignee Noah Slater, and a registration date of 2007-11-27; the assignment is dual-registered on both TCP and UDP with identical fields, and the IANA reference field is blank. In real-world deployment, 5984 is the default port for Apache CouchDB — an open-source NoSQL document database — but CouchDB's server speaks an HTTP-based RESTful API, which runs over TCP, not UDP. That HTTP API handles document CRUD, cluster replication and sync between nodes, and view queries. The same default port is used by CouchDB-adjacent deployments such as IBM Cloudant (a hosted CouchDB-compatible service) and Bitnami's CouchDB images. No sourced evidence shows CouchDB, or any other widely deployed software, actually transacting over UDP on 5984; the UDP registration appears to be a paired reservation rather than an in-use transport, so the UDP entry's real-world use is best treated as Unknown/not observed. Exposure and scanning activity documented for 5984 is TCP-based: the Shadowserver Foundation runs a recurring "Accessible CouchDB" report flagging misconfigured, publicly reachable instances that can leak database contents via the unauthenticated HTTP API (e.g., _all_dbs), and pentest write-ups describe attacking CouchDB over TCP/5984 (and 6984 for TLS). No dated, sourced report of UDP/5984-specific scanning or abuse was found — any UDP traffic there would most plausibly be generic port-sweep noise rather than protocol-specific exploitation, but that is inference, not a sourced fact.

IANA assignment

couchdb — "CouchDB"; reference (blank — no RFC cited in IANA registry); assignee Noah Slater; registration date 2007-11-27; dual-registered 5984/tcp + 5984/udp with identical fields [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cache lines 10206–10207); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5984

Range class

registered (1024–49151)

Related ports

6984 (CouchDB HTTPS/TLS); 5984/tcp (the in-use companion registration)

Primary use

default port for Apache CouchDB's HTTP-based RESTful API (document CRUD, cluster replication/sync, view queries) — but that API runs over TCP; no evidence of real UDP transport on this port [Confirmed for TCP service / Unknown for UDP] — https://docs.couchdb.org/en/latest/config/http.html , https://docs.couchdb.org/en/latest/setup/cluster.html

Common software

Apache CouchDB; related deployments IBM Cloudant (hosted CouchDB-compatible) and Bitnami CouchDB images, both defaulting to 5984 for the HTTP API

Security implications

Shadowserver "Accessible CouchDB" report flags exposed, misconfigured instances that can leak data via the unauthenticated HTTP API (e.g., _all_dbs); pentest guides cover CouchDB over TCP/5984 (and 6984 TLS) — all documented exposure is TCP-based, not UDP-specific [Likely] — https://www.shadowserver.org/what-we-do/network-reporting/accessible-couchdb-report/ , https://book.hacktricks.xyz/network-services-pentesting/5984-pentesting-couchdb

Typically seen on

hosts running Apache CouchDB (or Cloudant/Bitnami derivatives); a listening 5984 is almost always the TCP HTTP API

UDP-specific usage

Unknown — no sourced evidence of a real service or protocol actively using 5984/udp; third-party port databases mirror the paired IANA registration but document no UDP traffic [Unknown]

Analyst note

A responsive 5984 is virtually always the CouchDB HTTP API over TCP. Treat the UDP registration as a paired reservation with no observed real-world traffic; investigate any exposed instance for unauthenticated HTTP API access.