Technical impact
A resource‑management flaw in Apache CloudStack’s scoped global configuration causes database connections to remain open after they expire. When modules such as Quota and Host‑HA create or update configuration entries, the management server fails to release the database handles, allowing a backlog to grow until the pool is exhausted and the control plane becomes unresponsive. The weakness matches CWE-772 – missing release of resource – and results in an availability loss for the CloudStack control plane.
Affected Systems
Apache CloudStack versions 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected. The flaw resides in the management‑server component and is triggered by plugins or modules that manipulate scoped global configuration, including Quota, Host‑HA, and related plugins.
Risk and Exploitability
The vulnerability has a CVSS score of 6.8, indicating moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is an API or UI interaction that creates or updates scoped configuration entries; an attacker with access to the CloudStack API can possibly trigger the connection leak. Once the database connection pool is exhausted, the management server ceases to function, making the flaw a controlled‑resource denial of service risk.
