Resource Depletion Vulnerability in Apache CloudStack by Apache
CVE-2025-69233

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Cloudstack
Vendor
CVE Published:
8 May 2026

What is CVE-2025-69233?

This vulnerability in Apache CloudStack arises from multiple race conditions in the resource count check and increment logic, compounded by inadequate validations. As a result, attackers can manipulate the system to surpass the resource allocation limits set for their accounts or domains. This exploitation may lead to infrastructure resource depletion, causing significant service disruption or denial of service. Users are strongly encouraged to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, to mitigate this issue.

Affected Version(s)

Apache CloudStack 4.0.0 <= 4.20.2.0

Apache CloudStack 4.21.0.0 <= 4.22.0.0

References

https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02k...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fernando Oliveira <ferolicar82@gmail.com>
Gustavo Viana <viana.gust@gmail.com>
.