CVE-2025-14969

{
  "id": "CVE-2025-14969",
  "sourceIdentifier": "[email protected]",
  "published": "2026-01-26T20:16:08.313",
  "lastModified": "2026-10-20T05:16:53.077",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en Hibernate Reactive. Cuando un endpoint HTTP está expuesto para realizar operaciones de base de datos, un cliente remoto puede cerrar prematuramente la conexión HTTP. Esta acción puede provocar la fuga de conexiones del pool de conexiones de la base de datos, lo que podría causar una denegación de servicio (DoS) al agotar las conexiones de base de datos disponibles."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat build of Quarkus 3.27.2.redhat",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "org.hibernate.reactive/hibernate-reactive-core",
          "cpes": [
            "cpe:/a:redhat:quarkus:3.27"
          ],
          "versions": [
            {
              "version": "3.1.12.Final-redhat-00001",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "hibernate-reactive-core",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "quarkus-hibernate-reactive-panache",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "hibernate-reactive-core",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "quarkus-hibernate-reactive-panache",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Dev Spaces",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "devspaces/dashboard-rhel9",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Dev Spaces",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "devspaces/devspaces-operator-bundle",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-01-26T21:00:00.955979Z",
          "id": "CVE-2025-14969",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-772"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:1965",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2025-14969",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423822",
      "source": "[email protected]"
    }
  ]
}