Vulnerability in Hackney
CVE-2025-3864
Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library. Fix for this issue has been included in 1.24.0 release.
Published · last modified .
EPSS exploit prediction
EPSS: 0.008 (56.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 56.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Hackney — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/benoitc/hackney/issues/717 (issue-tracking)
- cert.pl/en/posts/2025/05/CVE-2025-3864/ (third-party-advisory)
- github.com/benoitc/hackney/commit/8f13ddac50d1626f8b9a47a08bd599e4efe1773d (patch)
Frequently asked questions
- What is CVE-2025-3864?
- CVE-2025-3864 is a vulnerability in Hackney, classified under Missing Release of Resource after Effective Lifetime. Published 2025-05-28.
- Is CVE-2025-3864 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.