This vulnerability in Apache CloudStack arises from multiple TOCTOU race conditions in the logic that checks and increments resource counts, along with missing validation steps. These flaws permit users to bypass allocation limits set on their accounts or domains, potentially leading to resource exhaustion and denial of service. The issue affects versions from 4.0.0 up to 4.21.0.0. The vendor has released fixed versions 4.20.3.0 and 4.22.0.1 that resolve the problem. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low complexity, requiring low privileges and no user interaction, impacting availability but not confidentiality or integrity.

Successful exploitation allows users to exceed resource allocation limits, which can degrade infrastructure resources and cause denial of service conditions. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits have been reported in the wild.

Users should upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1 or later, as these versions contain fixes for this vulnerability. Patch status is not explicitly stated beyond these recommended versions; therefore, confirm with the vendor advisory for the latest remediation guidance. No other mitigations are specified.