VulnerabilityDeferred
CVE-2025-3864
Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library.
LOW 2.3EPSS 0.83%
Does this matter?
Lower severity and a low EPSS score (0.83%). Track it; it rarely justifies an emergency change on its own.
Description
Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library. Fix for this issue has been included in 1.24.0 release.
- CVSS 4.0
- 2.3 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.83% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-772
- Source
- cvd@cert.pl
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.