This is an automated email from the ASF dual-hosted git repository. DaanHoogland pushed a commit to branch cve-2026-59654 in repository https://gitbox.apache.org/repos/asf/cloudstack-www.git
commit 9250caea7308a1b6c4c3dc1ab1a58ddf78d0ebd8 Author: Daan Hoogland <[email protected]> AuthorDate: Fri Aug 21 12:27:54 2026 +0200 cve-2026-59654 --- .../index.md | 27 ++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md b/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md index a0465384a..a49112d6b 100644 --- a/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md +++ b/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md @@ -14,6 +14,7 @@ The Apache CloudStack project announces the release of LTS releases [4.20.3.1](h - CVE-2026-50112 (severity 'Critical') - CVE-2026-50222 (severity 'Important') - CVE-2026-59085 (severity 'Moderate') +- CVE-2026-59654 (severity 'Medium') - CVE-2026-59655 (severity 'Moderate') - CVE-2026-59657 (severity 'Low') - CVE-2026-59780 (severity 'Low') @@ -169,6 +170,32 @@ addresses these issues. +## [CVE-2026-59654](https://www.cve.org/CVERecord?id=CVE-2026-59654): DoS caused by database connections leak + +Missing Release of Resource after Effective Lifetime vulnerability in +Apache CloudStack's scoped global configuration functionality. It +affects different modules and plugins of the CloudStack management +server, including Quota, Host-HA, etc., and may lead to eventual +denial of service (DoS) scenario for the management server. + +### Credits + +The CVEs are credited to the following reporters: + + - Henrique Sato <[email protected]> (reporter) + +### Affected versions: + + - Apache CloudStack 4.7.0 through 4.20.3.0 + - Apache CloudStack 4.21.0.0 through 4.22.1.0 + +### Resolution + +Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which +addresses these issues. + + + ## [CVE-2026-59655](https://www.cve.org/CVERecord?id=CVE-2026-59655): Unauthenticated OAuth provider client-secret disclosure Exposure of Sensitive Information to an Unauthorized Actor
