6.8Orta
CVE-2026-59654Apache CloudStack: DoS caused by database connections leak
Açıklama
Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server. This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Zayıflık türü (CWE):
CWE-772
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.7.0 – ≤ 4.20.3.0, 4.21.0.0 – ≤ 4.22.1.0 | |
| apache | cloudstack | 4.7.0 – < 4.20.3.1 |
Kaynaklar ve yamalar
- https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4 vendor-advisoryVendor Advisory
CPE eşleşmeleri (NVD) (2)
cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*≥ 4.7.0 < 4.20.3.1cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*≥ 4.21.0.0 < 4.22.1.1