PT-2026-38917 · Apache · Apache Cloudstack

Published 2026-05-08 · Updated 2026-05-09 · CVE-2025-69233

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions prior to 4.20.3.0 Apache CloudStack versions prior to 4.22.0.1

Description Multiple time-of-check time-of-use (TOCTOU) race conditions—where a system checks a condition and then uses the result, but the condition changes between the check and the use—exist in the resource count check and increment logic. Combined with missing validations, this allows users to exceed the allocation limits configured for their accounts or domains, potentially degrading infrastructure resources and leading to denial of service conditions.

Recommendations Upgrade to version 4.20.3.0 or later. Upgrade to version 4.22.0.1 or later.

Fix

DoS

Time Of Check To Time Of Use

Allocation of Resources Without Limits

Weakness Enumeration

CWE-367

CWE-770

Related Identifiers

CVE-2025-69233

Affected Products

Apache Cloudstack

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-69233 · Security Note
• https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2052768305094549940 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/09/5 · Note
• https://twitter.com/CVEnew/status/2053174673970528748 · Twitter Post
• https://t.me/cveNotify/162860 · Telegram Post