Denial Of Service (DoS)

org.hibernate.reactive, hibernate-reactive-core is vulnerable to a Denial of Service DoS. The vulnerability is due to improper handling of prematurely closed HTTP connections during database operations, which allows an attacker to exhaust the database connection pool by forcing connection leaks...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by Netty CRLF injection vulnerability, SCRAM authentication vulnerability, Hibernate Reactive database connection leak vulnerability and Quarkus REST worker thread exhaustion vulnerability. Vulnerability Details CVEID:CVE-2025-14969 DESCRIPTION:...

hibernate-reactive-core: Hibernate Reactive: Denial of Service due to connection leak on HTTP client disconnect

A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service DoS by...

Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.2 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...

io.quarkus:quarkus-hibernate-reactive (>=2.4.1.final, <=2.4.2.final), io.quarkus:quarkus-hibernate-reactive-deployment (>=2.4.1.final, <=2.4.2.final) +4 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (1.0.1.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.quarkus:quarkus-hibernate-reactive =2.4.1.final,...

io.quarkiverse.groovy:quarkus-groovy-hibernate-reactive-panache (>=3.24.0, <=3.24.1), io.quarkiverse.groovy:quarkus-groovy-hibernate-reactive-panache-deployment (>=3.24.0, <=3.24.1) +13 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (3.0.0.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 3.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.quarkiverse.groovy:quarkus-groovy-hibernate-reactive-panac...

io.quarkus:quarkus-hibernate-reactive (>=3.2.10.final, <=3.6.9), io.quarkus:quarkus-hibernate-reactive-deployment (>=3.2.10.final, <=3.6.9) +12 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (2.0.8.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 2.0.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.quarkus:quarkus-hibernate-reactive =3.2.10.final,...

GHSA-FRPP-8PWQ-HJRX Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion

A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service DoS by...

Missing Release of Resource after Effective Lifetime

Overview org.hibernate.reactive:hibernate-reactive-core is a The core module of Hibernate Reactive Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime by leaving transactions open in the connection pool. An attacker can cause resource exhaustio...

io.quarkus:quarkus-hibernate-reactive (>=3.27.3, <=3.27.3.1), io.quarkus:quarkus-hibernate-reactive-deployment (>=3.27.3, <=3.27.3.1) +12 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (3.1.13.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 3.1.13.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.quarkus:quarkus-hibernate-reactive =3.27.3, =3.27.3,...

io.quarkus:quarkus-hibernate-reactive (2.0.0.cr3), io.quarkus:quarkus-hibernate-reactive-deployment (2.0.0.cr3) +4 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (1.0.0.cr6)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 1.0.0.cr6 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.quarkus:quarkus-hibernate-reactive 2.0.0.cr3 -...

io.quarkus:quarkus-hibernate-reactive (>=2.1.0.cr1, <=2.1.4.final), io.quarkus:quarkus-hibernate-reactive-deployment (>=2.1.0.cr1, <=2.1.4.final) +4 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (1.0.0.cr8)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 1.0.0.cr8 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.quarkus:quarkus-hibernate-reactive =2.1.0.cr1, =2.1.0.cr1,...

io.micronaut.sql:micronaut-hibernate-reactive (5.0.0-m5), io.quarkiverse.groovy:quarkus-groovy-hibernate-reactive-panache (>=3.0.0, <=3.1.0) +14 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (2.0.0.cr1)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 2.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.micronaut.sql:micronaut-hibernate-reactive 5.0.0-m5 -...

io.quarkiverse.groovy:quarkus-groovy-hibernate-reactive-panache (>=3.26.3, <=3.28.1), io.quarkiverse.groovy:quarkus-groovy-hibernate-reactive-panache-deployment (>=3.26.3, <=3.28.1) +14 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (3.1.3.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 3.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.quarkiverse.groovy:quarkus-groovy-hibernate-reactive-panac...

io.micronaut.data:micronaut-data-hibernate-reactive (>=4.0.0-m7, <=4.0.0-m9), io.micronaut.sql:micronaut-hibernate-reactive (>=5.0.0-m8, <=5.0.0-m10) +12 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (2.0.0.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 2.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.micronaut.data:micronaut-data-hibernate-reactive =4.0.0-m7...

io.quarkiverse.flags:quarkus-flags-hibernate-reactive (1.0.1), io.quarkiverse.flags:quarkus-flags-hibernate-reactive-deployment (1.0.1) +14 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (3.2.13.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 3.2.13.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.quarkiverse.flags:quarkus-flags-hibernate-reactive 1.0.1 ...

cn.sliew:carp-ageiport-server (>=0.0.10, <=0.0.14), com.alibaba:ageiport-task-server (>=0.2.8, <=0.3.2) +19 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (2.0.4.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 2.0.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - cn.sliew:carp-ageiport-server =0.0.10, =0.2.8, =2.4.0.alpha2,...

com.peluware:omni-search-hibernate-reactive (>=2.1.2, <=2.1.3), io.debezium:debezium-quarkus-outbox-reactive (>=3.5.0.beta1, <=3.5.0.cr1) +17 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (3.2.2.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 3.2.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - com.peluware:omni-search-hibernate-reactive =2.1.2,...

io.quarkus:quarkus-hibernate-reactive (3.37.0.cr1), io.quarkus:quarkus-hibernate-reactive-deployment (3.37.0.cr1) +11 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (3.4.0.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 3.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.quarkus:quarkus-hibernate-reactive 3.37.0.cr1 -...

io.micronaut.data:micronaut-data-hibernate-reactive (>=4.0.0-m5, <=4.0.0-m6), io.micronaut.sql:micronaut-hibernate-reactive (>=5.0.0-m6, <=5.0.0-m7) potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (2.0.0.cr2)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 2.0.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.micronaut.data:micronaut-data-hibernate-reactive =4.0.0-m5,...