CVE-2026-59654

Apache CloudStack: DoS caused by database connections leak

State: Published
Severity: 6.8 Medium
Published: Aug 21, 2026
Updated: Aug 24, 2026
Reserved: Jul 6, 2026

Description

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.

This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Scores

CVSS	Score	Vector	Source
4.0	6.8 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H	apache

Weaknesses

CWE-772 Missing Release of Resource after Effective Lifetime

Affected Products

Product	Versions
Apache CloudStackApache Software Foundation	4.7.0 through 4.20.3.0Affected 4.21.0.0 through 4.22.1.0Affected

References

https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.