The vulnerability arises from time‑of‑check, time‑of‑use race conditions in CloudStack’s resource count check and increment logic, coupled with missing validations. An adversary can create or manipulate resources in such a way that the actual usage exceeds the configured limits for an account or domain. This failure to honor quotas can exhaust cluster or host resources, degrading performance and ultimately causing denial of service. The weakness maps to Time‑of‑Check Time‑of‑Use (CWE‑367) and Resource Exhaustion (CWE‑770).

The issue affects Apache CloudStack deployments managed by the Apache Software Foundation. Versions released prior to 4.20.3.0 or 4.22.0.1 are vulnerable, as the patch that corrects the race condition and enforces quota limits is included in those and later releases.

With a CVSS score of 6.5, the vulnerability presents moderate severity. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread known exploitation to date. However, since the attack requires ability to create resources beyond the configured quota, it is more likely to be exploited in multi‑tenant environments where users can submit resource requests that bypass the faulty quota checks. The potential impact of resource exhaustion makes the risk significant for operations that rely on consistent availability of network, compute, or storage resources.