CVE-2025-14969
Medium · 4.3CVSS
4.3
EPSS
0.4%
Published
Jan 26, 2026
CISA due date
—
The record
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.hibernate.reactive:hibernate-reactive-core | 0 | 4.2.1 |
Related vulnerabilities
- GHSA-frpp-8pwq-hjrx Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion Same vulnerability
- CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-772
- CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending forever. CWE-772
- CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets… CWE-772
- CVE-2026-59320 When a container-level ErrorHandler is configured (the mitigation for finding 221000)… CWE-772
- CVE-2026-73508 Netty is an asynchronous, event-driven network application framework. CWE-772
- CVE-2026-73215 Coturn is a free open source implementation of TURN and STUN Server. CWE-772
- CVE-2026-11811 The UpdateHub over-the-air update client's start_coap_client() in… CWE-772