CVE-2025-14969: Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion
(updated )
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
References
- access.redhat.com/errata/RHSA-2026:1965
- access.redhat.com/security/cve/CVE-2025-14969
- bugzilla.redhat.com/show_bug.cgi?id=2423822
- github.com/advisories/GHSA-frpp-8pwq-hjrx
- github.com/hibernate/hibernate-reactive
- github.com/hibernate/hibernate-reactive/commit/cd7f104e10de918004707ca0e26e3840976f780a
- nvd.nist.gov/vuln/detail/CVE-2025-14969
Code Behaviors & Features
Detect and mitigate CVE-2025-14969 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →