What is CVE-2025-3864?

CVE-2025-3864 is a vulnerability in Hackney, classified under Missing Release of Resource after Effective Lifetime. Published 2025-05-28.

Is CVE-2025-3864 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Hackney

CVE-2025-3864

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library. Fix for this issue has been included in 1.24.0 release.

EPSS: 0.007 (50.6th percentile) — read the EPSS interpretation.

Affected products

Hackney — versions 0

Weakness classification (CWE)

CWE-772 — Missing Release of Resource after Effective Lifetime

Public proof-of-concept exploits

afine-com/research

References

cvd@cert.pl (issue-tracking)
cvd@cert.pl (third-party-advisory)
cvd@cert.pl (patch)

Frequently asked questions

What is CVE-2025-3864?: CVE-2025-3864 is a vulnerability in Hackney, classified under Missing Release of Resource after Effective Lifetime. Published 2025-05-28.
Is CVE-2025-3864 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.