CVE-2026-59654: Apache CloudStack: DoS caused by database connections leak
Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.
This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CloudStack management serverto a version that resolves this vulnerability.Fixed in 4.20.3.1 - Upgrade
Upgrade
Apache CloudStack management serverto a version that resolves this vulnerability.Fixed in 4.22.1.1
Event History
Frequently Asked Questions
Which deployments are affected?
Apache CloudStack management servers running versions 4.7.0 through 4.20.3.0, or 4.21.0.0 through 4.22.1.0, are affected. The issue involves scoped global configuration functionality across modules and plugins including Quota and Host-HA.
What should teams do to remediate the issue?
Upgrade to Apache CloudStack 4.20.3.1 or 4.22.1.1, or a later version. These releases contain the fix.
How can I determine whether my environment needs remediation?
Check the CloudStack version on each management server. Systems in either affected version range should be upgraded, particularly where scoped global configuration is used.