Riskcovery

CVE-2025-69233

Apache CloudStack: Domain/account resources limits not honored

State
Published
Severity
6.5 Medium
Published
May 8, 2026
Updated
May 9, 2026
Reserved
Dec 29, 2025

Read the record on cve.org

Description

Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure's resources and lead to denial of service conditions.

Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hapache

Weaknesses

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

ProductVersions
Apache CloudStackApache Software Foundation
  • 4.0.0 through 4.20.2.0Affected
  • 4.21.0.0 through 4.22.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.