CVE-2026-59654

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.7.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0

Description A Missing Release of Resource after Effective Lifetime issue exists within the scoped global configuration functionality. This flaw affects various modules and plugins of the management server, such as Quota and Host-HA, causing a database connection leak. This can result in a denial of service (DoS) scenario for the management server.

Recommendations Upgrade versions 4.7.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.