CVE-2026-59654CWE-772

CVE-2026-59654

High · published August 21, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.6
In the wild
Unconfirmed
What it is

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.

This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
6.8 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
EPSS
0.00591 · 47.6th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-08-21T17:18Z
Affected products (2)
ProductVersionsFixed in
apache/cloudstack≥ 4.7.0, < 4.20.3.14.20.3.1
apache/cloudstack≥ 4.21.0.0, < 4.22.1.14.22.1.1
References (1)
https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4 · [email protected]
EPSS history
Timeline
  • 21 AUG 12:33Z
    Apache CloudStack: DoS caused by database connections leak
    cvelistv5