CVE-2025-69233: apache software foundation apache cloudstack
Vulnerability summary
CVE-2025-69233 is a medium (CVSS 6.5) vulnerability in apache software foundation apache cloudstack. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.1% of scored vulnerabilities.
Timeline
- 08-05-2026PublishedVulnerability first disclosed.
- 09-05-2026Last modifiedVulnerability information updated.
Description
Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure's resources and lead to denial of service conditions. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Apache1 product
- cloudstack≥ 4.0.0, < 4.20.3.0 | ≥ 4.21.0.0, < 4.22.0.1
Apache software foundation1 product
- apache cloudstack≥ 4.0.0, ≤ 4.20.2.0 | ≥ 4.21.0.0, ≤ 4.22.0.0
2 vendors · 2 products