This is an automated email from the ASF dual-hosted git repository.
DaanHoogland pushed a commit to branch staging-site
in repository https://gitbox.apache.org/repos/asf/cloudstack-www.git
The following commit(s) were added to refs/heads/staging-site by this push:
new af11f44fe cve-2026-59654 (#450)
af11f44fe is described below
commit af11f44fee16dcc93d6596930160956ef208bfa2
Author: dahn <[email protected]>
AuthorDate: Fri Aug 21 12:57:42 2026 +0200
cve-2026-59654 (#450)
Co-authored-by: Daan Hoogland <[email protected]>
---
.../index.md | 27 ++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git
a/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md
b/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md
index a0465384a..a49112d6b 100644
--- a/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md
+++ b/blog/2026-08-18-security-release-advisory-4.20.3.1-4.22.1.1/index.md
@@ -14,6 +14,7 @@ The Apache CloudStack project announces the release of LTS
releases [4.20.3.1](h
- CVE-2026-50112 (severity 'Critical')
- CVE-2026-50222 (severity 'Important')
- CVE-2026-59085 (severity 'Moderate')
+- CVE-2026-59654 (severity 'Medium')
- CVE-2026-59655 (severity 'Moderate')
- CVE-2026-59657 (severity 'Low')
- CVE-2026-59780 (severity 'Low')
@@ -169,6 +170,32 @@ addresses these issues.
+## [CVE-2026-59654](https://www.cve.org/CVERecord?id=CVE-2026-59654): DoS
caused by database connections leak
+
+Missing Release of Resource after Effective Lifetime vulnerability in
+Apache CloudStack's scoped global configuration functionality. It
+affects different modules and plugins of the CloudStack management
+server, including Quota, Host-HA, etc., and may lead to eventual
+denial of service (DoS) scenario for the management server.
+
+### Credits
+
+The CVEs are credited to the following reporters:
+
+ - Henrique Sato <[email protected]> (reporter)
+
+### Affected versions:
+
+ - Apache CloudStack 4.7.0 through 4.20.3.0
+ - Apache CloudStack 4.21.0.0 through 4.22.1.0
+
+### Resolution
+
+Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later,
which
+addresses these issues.
+
+
+
## [CVE-2026-59655](https://www.cve.org/CVERecord?id=CVE-2026-59655):
Unauthenticated OAuth provider client-secret disclosure
Exposure of Sensitive Information to an Unauthorized Actor
