CVE-2025-69233

Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure's resources and lead to denial of service conditions. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/09/5

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cloudstack::::::::
	cpe:2.3:a:apache:cloudstack::::::::

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Debido a múltiples condiciones de carrera de tiempo de verificación y tiempo de uso en la lógica de verificación e incremento del recuento de recursos, así como a validaciones faltantes, los usuarios de la plataforma pueden exceder los límites de asignación configurados para sus cuentas/dominios. Esto puede ser utilizado por un atacante para degradar los recursos de la infraestructura y conducir a condiciones de denegación de servicio. Se recomienda a los usuarios actualizar a las versiones de Apache CloudStack 4.20.3.0 o 4.22.0.1, o posteriores, que soluciona este problema.

Information

Published : 2026-05-08 13:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-69233

Mitre link : CVE-2025-69233

CVE.ORG link : CVE-2025-69233

JSON object : View

Products Affected

apache

cloudstack

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-69233", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69233", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T13:55:11.565884Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CloudStack", "versions": [{"status": "affected", "version": "4.0.0", "versionType": "semver", "lessThanOrEqual": "4.20.2.0"}, {"status": "affected", "version": "4.21.0.0", "versionType": "semver", "lessThanOrEqual": "4.22.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-08T13:16:35.993", "references": [{"url": "https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/09/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure's resources and lead to denial of service conditions.\n\nUsers are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue."}, {"lang": "es", "value": "Debido a m\u00faltiples condiciones de carrera de tiempo de verificaci\u00f3n y tiempo de uso en la l\u00f3gica de verificaci\u00f3n e incremento del recuento de recursos, as\u00ed como a validaciones faltantes, los usuarios de la plataforma pueden exceder los l\u00edmites de asignaci\u00f3n configurados para sus cuentas/dominios. Esto puede ser utilizado por un atacante para degradar los recursos de la infraestructura y conducir a condiciones de denegaci\u00f3n de servicio. Se recomienda a los usuarios actualizar a las versiones de Apache CloudStack 4.20.3.0 o 4.22.0.1, o posteriores, que soluciona este problema."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0820043-939A-4549-AE30-03196C079366", "versionEndExcluding": "4.20.3.0", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78690ED1-C4B3-4DC9-9B53-FB31D6D17125", "versionEndExcluding": "4.22.0.1", "versionStartIncluding": "4.21.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}