CVE-2025-3864 json
Connection pool exhaustion in hackney
published 2025-05-28 17 mo ago modified 2026-06-17 4 mo ago also GHSA-9fm9-hp7p-53mf , EUVD-2025-16328
- cvss
- 2.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library. Fix for this issue has been included in 1.24.0 release.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | hackney | <1.24.0 |
1.24.0 |
Affected products
- hackney hackney
Classification
- Weakness
-
- CWE-772 Missing Release of Resource after Effective Lifetime
References
-
github.com
/benoitc/hackney/commit/8f13ddac50d1626f8b9a47a08bd599e4efe1773d
patch, web
-
github.com
/benoitc/hackney/issues/717
issue-tracking, web
-
cert.pl
/en/posts/2025/05/CVE-2025-3864/
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-3864
advisory
-
cert.pl
/en/posts/2025/05/CVE-2025-3864
web
-
github.com
/benoitc/hackney
package
Sources
- CVE List CVE-2025-3864
- GitHub Advisory GHSA-9fm9-hp7p-53mf
- NVD CVE-2025-3864
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.