Apache CloudStack up to 4.20.2.0/4.22.0.0 toctou

Summaryinfo

A vulnerability has been found in Apache CloudStack up to 4.20.2.0/4.22.0.0 and classified as problematic. This impacts an unknown function. Performing a manipulation results in toctou. This vulnerability is known as CVE-2025-69233. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apache CloudStack up to 4.20.2.0/4.22.0.0. It has been classified as problematic. This affects an unknown part. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on availability. The summary by CVE is:

Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure's resources and lead to denial of service conditions. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

The advisory is shared at lists.apache.org. This vulnerability is uniquely identified as CVE-2025-69233 since 12/30/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/08/2026).

Upgrading to version 4.20.3.0 or 4.22.0.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1438). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Apache CloudStack

Productinfo

Type

• Cloud Software

Vendor

• Apache

Name

• CloudStack

Version

• 4.20.0
• 4.20.1
• 4.20.2.0
• 4.22.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion