4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-14969

CVE-2025-14969: Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect

A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-14969

CVE-2025-14969:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.hibernate.reactive:hibernate-reactive-core	maven	< 4.2.1	4.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is a connection leak issue in Hibernate Reactive, leading to a potential Denial of Service. The root cause is the improper handling of connection closing when a transaction is still active. By analyzing the provided commit cd7f104e10de918004707ca0e26e3840976f780a, I identified the exact code change that addresses this flaw.

The patch significantly modifies the close() method in the org.hibernate.reactive.pool.impl.SqlClientConnection class. The original implementation explicitly checked for an active transaction and threw an IllegalStateException if one was found. This behavior is the direct cause of the vulnerability. The exception would prevent the connection from being properly closed and returned to the pool.

The fix introduces a new method, validateNoTransactionInProgressOnClose, which is called by the close() method. This new logic ensures that if a transaction is in progress, it is rolled back before the connection is closed. While it still signals an error (by returning a failed CompletionStage), it no longer leaves the connection in a leaked state. The connection is now always closed, and the active transaction is terminated, thus fixing the resource leak.

Therefore, the primary vulnerable function is org.hibernate.reactive.pool.impl.SqlClientConnection.close() as it existed before this patch. During exploitation, this function would be called, and its flawed logic would be the trigger for the connection leak.

Vulnerable functions

org.hibernate.reactive.pool.impl.SqlClientConnection.close

hibernate-reactive-core/src/main/java/org/hibernate/reactive/pool/impl/SqlClientConnection.java

The vulnerability lies in the `close()` method of the `SqlClientConnection` class. Before the patch, if this method was called while a database transaction was still active, it would throw an `IllegalStateException`. This exception would interrupt the normal connection closing process, preventing the connection from being returned to the connection pool. An attacker could repeatedly trigger this condition by sending requests that start a transaction and then prematurely closing the connection, leading to a leak of all available connections from the pool and causing a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.