{"id":"CVE-2025-14969","title":"hibernate-reactive-core: Hibernate Reactive: Denial of Service due to connection leak on HTTP client disconnect (CVE-2025-14969)","summary":"A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection po…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":"CWE-772","vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.2.redhat","affected":["build_of_quarkus 3.27.2.redhat"],"patched":["build_of_quarkus 3.27.2.redhat"],"published":"2025-12-19","updated":"2026-10-20","sourceUpdated":"2026-10-20T05:00:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14969.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14969.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-14969"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2423822"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14969"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14969"},{"url":"https://access.redhat.com/errata/RHSA-2026:1965"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00415,"epssPercentile":0.34359,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-01-26T21:00:00.955979Z"},"ingestedAt":"2026-10-20T04:52:44.230Z","slug":"CVE-2025-14969","body":"## Overview\n\nA flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.\n\n## Vendor advisories\n\n- **RHSA-2026:1965** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.2.redhat · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:1965)\n\n**hibernate-reactive-core: Hibernate Reactive: Denial of Service due to connection leak on HTTP client disconnect** — rated Moderate by Red Hat. Released 2025-12-19, updated 2026-10-20.\n\nFixed:\n\n- Red Hat build of Quarkus 3.27.2.redhat\n\nNot affected:\n\n- Red Hat build of Quarkus 3.27.2.redhat\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat OpenShift Dev Spaces\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:1965\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}