6.8Medium
CVE-2026-59654Apache CloudStack: DoS caused by database connections leak
Description
Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server. This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Weakness (CWE):
CWE-772
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.7.0 – ≤ 4.20.3.0, 4.21.0.0 – ≤ 4.22.1.0 | |
| apache | cloudstack | 4.7.0 – < 4.20.3.1 |
References and patches
- https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4 vendor-advisoryVendor Advisory
CPE matches (NVD) (2)
cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*≥ 4.7.0 < 4.20.3.1cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*≥ 4.21.0.0 < 4.22.1.1