PT-2025-23077 · Hackney · Hackney

Marcin Wyczechowski + 2 · Published 2025-05-28 · Updated 2026-01-26 · CVE-2025-3864

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Hackney versions prior to 1.24.0

Description The issue arises from Hackney's failure to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. This allows remote attackers to exhaust connection pools, resulting in denial of service in applications that use the library.

Recommendations For versions prior to 1.24.0, update to version 1.24.0 to resolve the issue.

Fix

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2025-3864

GHSA-9FM9-HP7P-53MF

Affected Products

Hackney

References · 12

• https://github.com/benoitc/hackney/commit/8f13ddac50d1626f8b9a47a08bd599e4efe1773d · Patch
• https://osv.dev/vulnerability/CVE-2025-3864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3864 · Security Note
• https://osv.dev/vulnerability/GHSA-9fm9-hp7p-53mf · Vendor Advisory
• https://github.com/benoitc/hackney/issues/717 · Note
• https://github.com/benoitc/hackney · Note
• https://cert.pl/en/posts/2025/05/CVE-2025-3864 · Note
• https://twitter.com/VulmonFeeds/status/1927714227118023019 · Twitter Post
• https://t.me/cvetracker/24814 · Telegram Post
• https://twitter.com/CVEnew/status/1927691399018725679 · Twitter Post
• https://t.me/cvenotify/123817 · Telegram Post
• https://t.me/cveNotify/149848 · Telegram Post