CVE-2025-14969
Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
- Record
CVE-2025-14969- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
EUVDEUVD-2025-206338
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
- Record
EUVD-2025-206338- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-frpp-8pwq-hjrx
Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
- Record
GHSA-frpp-8pwq-hjrx- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
NVD
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
- Record
CVE-2025-14969- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
OSVGHSA-frpp-8pwq-hjrx
Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
- Record
GHSA-frpp-8pwq-hjrx- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.hibernate.reactive:hibernate-reactive-coreMaven |
before 4.2.1 | 4.2.1 |
org.hibernate.reactive:hibernate-reactive-coreMaven |
before 4.2.1, plus listed versions 1.0.0.Alpha101.0.0.Alpha111.0.0.Alpha21.0.0.Alpha31.0.0.Alpha4 Show 45 moreShow less1.0.0.Alpha51.0.0.Alpha61.0.0.Alpha71.0.0.Alpha81.0.0.Alpha91.0.0.Beta11.0.0.Beta21.0.0.Beta31.0.0.Beta41.0.0.CR11.0.0.CR101.0.0.CR21.0.0.CR31.0.0.CR41.0.0.CR51.0.0.CR61.0.0.CR71.0.0.CR81.0.0.CR91.0.0.Final1.0.1.Final1.0.2.Final1.0.3.Final1.1.0.Final1.1.1.Final1.1.2.Final1.1.3.Final1.1.4.Final1.1.5.Beta21.1.5.Final1.1.6.Final1.1.7.Final1.1.8.Final1.1.9.Final2.0.0.Alpha12.0.0.Alpha22.0.0.Beta12.0.0.Beta22.0.0.CR12.0.0.CR22.0.0.Final2.0.1.Final2.0.2.Final2.0.3.Final2.0.4.Final |
4.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-14969 is a medium vulnerability (CVSS 4.3) in Red Hat Build Of Quarkus 3.27.2.redhat, published January 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in org.hibernate.reactive:hibernate-reactive-core 4.2.1.
References
access.redhat.com/errata/RHSA-2026:1965
bugzilla.redhat.com/show_bug.cgi?id=2423822
nvd.nist.gov/vuln/detail/CVE-2025-14969
github.com/hibernate/hibernate-reactive/commit/cd7f104e10de918004707ca0e26e3840976f780a
Left out here: 125 versions. The JSON record has them.