6.8Mittel
CVE-2026-59654Apache CloudStack: DoS caused by database connections leak
Beschreibung
Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server. This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Schwachstellentyp (CWE):
CWE-772
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.7.0 – ≤ 4.20.3.0, 4.21.0.0 – ≤ 4.22.1.0 | |
| apache | cloudstack | 4.7.0 – < 4.20.3.1 |
Referenzen und Patches
- https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4 vendor-advisoryVendor Advisory
CPE-Treffer (NVD) (2)
cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*≥ 4.7.0 < 4.20.3.1cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*≥ 4.21.0.0 < 4.22.1.1