Bug 2423822 (CVE-2025-14969)

Summary: CVE-2025-14969 hibernate-reactive-core: Hibernate Reactive: Denial of Service due to connection leak on HTTP client disconnect
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anstephe, asoldano, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, clement.escoffier, dandread, darran.lofthouse, dkreling, dosoudil, gsmet, istudens, ivassile, iweiss, jmartisk, lthon, manderse, mosmerov, msvehla, nwallace, olubyans, pberan, pesilva, pgallagh, pjindal, pmackay, probinso, rguimara, rruss, rstancel, rsvoboda, sbiarozk, sdawley, smaestri, tom.jenkinson, tqvarnst
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-12-19 10:56:11 UTC
When using Hibernate Reactive and exposing an HTTP endpoint to execute some database operations, if the client closes the HTTP connection (e.g. closes the browser, cancels the loading of the page), there's a chance that it leads to leaking connections from the DB connection pool.