CVE-2026-59654 is a high severity denial of service in Apache CloudStack. A missing release of resources in scoped global configuration, used by Quota and Host-HA among others, can eventually take down the management server. Upgrade to 4.20.3.1 or 4.22.1.1 or later.
What's affected
- Product: Apache CloudStack management server.
- Affected: 4.7.0 through 4.20.3.0, and 4.21.0.0 through 4.22.1.0.
- Fixed: 4.20.3.1 or 4.22.1.1, or later, per the record.
- Affected areas named in the record: modules and plugins such as Quota and Host-HA that use scoped global configuration.
How to check if you're exposed
Find the CloudStack version of your management server. The management UI shows it, and so does the capabilities API.
cmk list capabilities | grep -i version
If you run packages from a repository, compare the installed package version with 4.20.3.1 or 4.22.1.1. Both the 4.20 and 4.22 lines have a fixed release, and the 4.21 line is affected through 4.22.1.0, so 4.21 users must move to a fixed line.
Also watch the management server for slow growth in memory use over time, since the flaw is a gradual leak, not a sudden crash.
What to do now
- Upgrade to CloudStack 4.20.3.1 or 4.22.1.1 or later.
- If you run 4.21, plan a move to a fixed release line.
- Monitor the management server heap and restart on a schedule until you have upgraded.
- Subscribe to the CloudStack security mailing list for follow up guidance.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-772 (Missing Release of Resource after Effective Lifetime). The record says the scoped global configuration feature fails to release resources it no longer needs, across several modules and plugins of the management server. Over time that builds up, and the management server stops working.
Management server downtime does not usually stop running virtual machines, but it stops you from operating the cloud: no new instances, no changes, and no automated recovery that depends on it. The record scores it 7.5 (High) with a network vector and no privileges required. The Apache announcement page did not return readable text when fetched, so the record's description is the only source for the details here. The record does not mark it as exploited in the wild.
If you operate CloudStack for tenants, plan the upgrade as a normal maintenance window. The fix releases are point releases on the 4.20 and 4.22 lines, so they should be lower risk than a feature upgrade, but test them against your own plugins and Quota or Host-HA settings first.
Quick check
Which versions fix it?
Per the record, 4.20.3.1 or 4.22.1.1, or later. Versions 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected.
Sources
Last reviewed: 18 October 2026.
