GHSA-9fm9-hp7p-53mf

ghsaUSosv

Hackney fails to properly release HTTP connections to the pool

view advisory published 2025-05-28Licence: CC-BY-4.0

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library. Fix for this issue has been included in 1.24.0 release.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-3864US	—	0.87% (59th)	—	2025-05-28
Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causi…

references

External citations — patches, advisories, analysis.

https://cert.pl/en/posts/2025/05/CVE-2025-3864WEB
https://github.com/benoitc/hackneyPACKAGE
https://github.com/benoitc/hackney/commit/8f13ddac50d1626f8b9a47a08bd599e4efe1773dWEB
https://github.com/benoitc/hackney/issues/717WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-3864ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan