EUVD-2026-63941
GHSA-9j4g-grw7-5966
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low-privilege auth (PR:L) and user interaction (UI:R); scope changed (S:C) because management server DoS cascades availability impact to all managed workloads.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.
This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
AnalysisAI
Resource exhaustion in Apache CloudStack's scoped global configuration subsystem-spanning versions 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0-allows authenticated low-privilege users to gradually trigger a denial-of-service condition against the management server. The vulnerability (CWE-772) affects multiple plugins including Quota and Host-HA, which allocate resources during configuration operations but fail to release them after their effective lifetime. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the Apache CloudStack management server API with at least low-privilege authenticated credentials, as confirmed by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.8 with vector AV:N/AC:L/AT:P/PR:L/UI:A reflects a network-reachable flaw requiring low-privilege authentication and active user interaction, with AT:P (specific attack conditions required) indicating that exploitation is not trivially automated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache CloudStack to version 4.20.3.1 (for deployments on the 4.20.x LTS branch) or 4.22.1.1 (for deployments on the 4.22.x branch) or any later release, as confirmed by the Apache advisory at https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Cloudstack
View allCross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes
Two-factor authentication bypass in Apache CloudStack allows an authenticated low-privileged user to exploit an improper
Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticat
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAM
Authenticated CloudStack users can hijack volumes from other tenants' backups via the Backup plugin in versions 4.21.0.0
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authenticati
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows u
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to an
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating o
Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issui
Improper access control in the CloudStack Backup plugin allows authenticated users in CloudStack 4.21.0.0 through 4.22.0
Improper authorization logic in the CloudStack Backup plugin allows authenticated users to enumerate backups from any ac
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today