CVE-2025-69233

MediumCVSS 5.3/10Last modified Oct 7, 2026

Description

Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure's resources and lead to denial of service conditions.

Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-367CWE-770

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2026
Last modified
Oct 7, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-692349.1Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.CVE-2025-692357.5Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.CVE-2025-692365.4Raytha CMS is vulnerable to Stored XSS via FieldValues[1].Value parameter in post editing functionality. Authenticated attacker with permissCVE-2025-692375.4Raytha CMS is vulnerable to Stored XSS via FieldValues[0].Value parameter in page creation functionality. Authenticated attacker with permisCVE-2025-692384.3Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. Attacker can craft special website, which when visited by CVE-2025-692392.7Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privilegeCVE-2025-69245.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP AutomatioCVE-2025-692408.8Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victiCVE-2025-692415.4Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inCVE-2025-692426.1Raytha CMS is vulnerable to reflected XSS via the backToListUrl parameter. An attacker can craft a malicious URL which, when opened by autheCVE-2025-692435.3Raytha CMS is vulnerable to User Enumeration in password reset functionality. Difference in messages could allow an attacker to determine ifCVE-2025-692456.1Raytha CMS is vulnerable to Reflected XSS via returnUrl parameter in logon functionality. An attacker can craft a malicious URL which, when
CVE-2025-69233: Medium severity, CVSS 5.3 | Vulnix