CVE-2025-3864CWE-772

Connection pool exhaustion in hackney

Low · published May 28, 2025

CVSS v4.0
2.3
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library.

Fix for this issue has been included in 1.24.0 release.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00834 · 57.3th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2025-05-28T11:19Z
EPSS history
Timeline
  • 28 MAY 11:19Z
    Connection pool exhaustion in hackney
    cvelistv5