CVE-2025-69233

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada apache cloudstack. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure's resources and lead to denial of service conditions. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/05/09/5