CVE-2025-3864 - CVE House
Back to Database
Status published Low CVE-2025-3864

Connection pool exhaustion in hackney

Vulnerability Description

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library. Fix for this issue has been included in 1.24.0 release.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3864

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Michał Majchrowicz, Marcin Wyczechowski, and Paweł Zdunek — members of the AFINE Team

References

Affected Vendor

Affected Software

hackney
Vulnerable Versions:
0

Timeline

Official Publish: May 28th, 2025
Last Modified: January 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-772

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.