CVE-2025-14969: Hibernate Reactive Connection Pool Exhaustion Vulnerability
Summary
CVE-2025-14969: Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion. Affects org.hibernate.reactive:hibernate-reactive-core versions < 4.2.1. Fixed in 4.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hibernate Reactive is a framework that enables reactive programming with Hibernate ORM, allowing developers to build non-blocking applications that interact with databases. It is designed to work seamlessly with reactive programming paradigms, providing efficient database access. However, it is susceptible to a vulnerability that can lead to connection pool exhaustion, impacting application availability.
Vulnerability Detail
A flaw exists in Hibernate Reactive where an HTTP endpoint, when exposed for database operations, allows a remote client to prematurely close the HTTP connection. This premature closure can result in leaking connections from the database connection pool. If enough connections are leaked, it can lead to a Denial of Service (DoS) condition, where the application can no longer obtain database connections, severely affecting its functionality and availability.
How To Fix
Minimum fixed version
4.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing connection timeout settings in your database configuration to limit the impact of leaked connections. Additionally, ensure that your application properly handles connection closure and implements retry logic for database operations.
Conclusion
The Hibernate Reactive vulnerability (CVE-2025-14969) poses a risk of connection pool exhaustion, which can lead to Denial of Service. It is crucial to update to version 4.2.1 or later to mitigate this risk. Implementing workarounds can help manage the impact until an update is feasible.
See every vulnerability recorded for org.hibernate.reactive:hibernate-reactive-core →
FAQ
The vulnerability can lead to Denial of Service (DoS) by exhausting available database connections, making the application unable to perform database operations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Yes, the vulnerability is patched in version 4.2.1 of the Hibernate Reactive package.
If an immediate update is not possible, consider implementing connection timeout settings and ensuring proper connection handling in your application as a temporary measure.
