CVE-2026-59654— Apache CloudStack: DoS caused by database connections leak
Quick assessment
Affected
Apache Software Foundation Apache CloudStack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache CloudStack 的全局作用域配置功能存在“有效生命周期结束后未释放资源”漏洞。该漏洞会影响 CloudStack 管理服务器的不同模块和插件，包括配额管理（Quota）、主机高可用（Host-HA）等，可能导致管理服务器最终出现拒绝服务（DoS）情况。 此漏洞影响以下版本的 Apache CloudStack： 4.7.0 至 4.20.3.0 4.21.0.0 至 4.22.1.0 建议用户升级至 4.20.3.1 或 4.22.1.1 及更高版本，这些版本已修复该问题。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.7.0≤ 4.20.3.0 |
affected |
4.21.0.0≤ 4.22.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59654
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CloudStack: DoS caused by database connections leak
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.
This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
对已超过有效生命周期的资源丧失索引
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.7.0 ~ 4.20.3.0 | - |
|
II. Public POCs for CVE-2026-59654
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59654
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-59654 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-21 · 21 CVEs total
| CVE-2026-61398 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Fun | |
| CVE-2026-68745 | Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP | |
| CVE-2026-66797 | Apache CloudStack: Unauthorised comment creation and disclosure | |
| CVE-2026-66722 | Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue | |
| CVE-2026-66721 | Apache CloudStack: Authorization issue with listHostTags for domain admins | |
| CVE-2026-65613 | Apache CloudStack: Webhook Deliveries Incorrect Access | |
| CVE-2026-62440 | Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulatio | |
| CVE-2026-61422 | Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate | |
| CVE-2026-61400 | Apache CloudStack: Get and Run Diagnostics Command Injection | |
| CVE-2026-61399 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI | |
| CVE-2026-63046 | Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials | |
| CVE-2026-61397 | Apache CloudStack: OAuth2 Token Cross-Request Leak | |
| CVE-2026-59799 | Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow | |
| CVE-2026-59780 | Apache CloudStack: LDAP provider configuration disclosure | |
| CVE-2026-59657 | Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob | |
| CVE-2026-59655 | Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure | |
| CVE-2026-59085 | Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module | |
| CVE-2026-50222 | Apache CloudStack: Improper access control in Userdata reference APIs | |
| CVE-2026-50112 | Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates | |
| CVE-2026-47359 | Apache CloudStack: OS Command Injection due to unsanitized mount command |
IV. Related Vulnerabilities
Same product: Apache CloudStack
-
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer -
CVE-2026-59085
Apache CloudStack: Server-Side Request Forgery (SSRF) vulner -
CVE-2026-59655
Apache CloudStack: Unauthenticated OAuth provider client-sec
Same vendor: Apache Software Foundation
-
CVE-2026-73180
Apache Tomcat: Authenticated WebSocket session survives end -
CVE-2026-68763
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tra -
CVE-2026-68569
Apache Tomcat: Principal lookup can fail open in some cases -
CVE-2026-68525
Apache Tomcat: Redirect after FORM auth may bypass method sp -
CVE-2026-66422
Apache Tomcat: Servlet role references can bypass declarativ
Same weakness: CWE-772
-
CVE-2026-73508
Netty: Memory Leak in DNS Record Decoder via Malformed Domai -
CVE-2026-11811
Socket file-descriptor leak in UpdateHub OTA client start_co -
CVE-2026-13505
Zeroisation of sensitive key material on garbage collection -
CVE-2026-20124
Cisco IOS XE Software SNMP Denial of Service Vulnerability -
CVE-2026-64607
Apache HttpComponents Client: Connection Leak on Content-Enc
V. Comments for CVE-2026-59654
No comments yet