CVE-2025-69233

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-69233

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69233.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-69233

Published

2026-05-08T12:19:30.874Z

Modified

2026-07-15T01:49:04.732743875Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Apache CloudStack: Domain/account resources limits not honored

Details

Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure's resources and lead to denial of service conditions.

Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-367",
        "CWE-770"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.20.2.0"
                },
                {
                    "introduced": "4.21.0.0"
                },
                {
                    "last_affected": "4.22.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69233.json"
}

References

Affected packages

Git / github.com/apache/cloudstack

Affected ranges

Type

GIT

Repo

https://github.com/apache/cloudstack

Events

Introduced

6355965dcd956811dd471a9d03c73dadcf68f480

Fixed

c8599040b4756034c7105806a53d2c99eb7ea0fe

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.20.3.0"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69233.json"