---
id: CVE-2025-14969
title: >-
  hibernate-reactive-core: Hibernate Reactive: Denial of Service due to
  connection leak on HTTP client disconnect (CVE-2025-14969)
summary: >-
  A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to
  perform database operations, a remote client can prematurely close the HTTP
  connection. This action may lead to leaking connections from the database
  connection po…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe: CWE-772
vendor: Red Hat
product: Red Hat build of Quarkus 3.27.2.redhat
affected:
  - build_of_quarkus 3.27.2.redhat
patched:
  - build_of_quarkus 3.27.2.redhat
published: '2025-12-19'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T05:00:38+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14969.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14969.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-14969'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2423822'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-14969'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14969'
  - url: 'https://access.redhat.com/errata/RHSA-2026:1965'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00415
epssPercentile: 0.34359
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-01-26T21:00:00.955979Z'
ingestedAt: '2026-10-20T04:52:44.230Z'
---

## Overview

A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.

## Vendor advisories

- **RHSA-2026:1965** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.2.redhat · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:1965)

**hibernate-reactive-core: Hibernate Reactive: Denial of Service due to connection leak on HTTP client disconnect** — rated Moderate by Red Hat. Released 2025-12-19, updated 2026-10-20.

Fixed:

- Red Hat build of Quarkus 3.27.2.redhat

Not affected:

- Red Hat build of Quarkus 3.27.2.redhat
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Dev Spaces

## Remediation

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:1965

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.