CVE-2025-3864 Vulnerability Summary
CVE ID: CVE-2025-3864
Publication Date: May 28, 2025
Vendor: Hackney Software
Product: Hackney Software (Rental Machine)
Vulnerable Versions: All versions prior to 1.24.0
Vulnerability Type (CWE): Resource Release Failure After Effective Lifetime (CWE-772)
Reporting Source: CERT Polska
Description
CERT Polska has disclosed a significant vulnerability in Hackney Software, identified as CVE-2025-3864. This vulnerability involves a failure of Hackney to properly release HTTP connections back to the pool after handling temporary redirect responses (specifically, HTTP status 307). As a result, remote attackers can exploit this issue, leading to connection pooling exhaustion and potentially causing a denial of service (DoS) in applications that utilize this library.
The affected versions encompass all prior to 1.24.0, hence it is imperative for users of Hackney Software to ensure they update to this version or later to mitigate the risk.
Impact
The exploitation of CVE-2025-3864 allows malicious actors to monopolize available connections within the connection pool by repeatedly triggering the vulnerability. This can lead to service unavailability, significantly impacting user experience and operational continuity for applications relying on Hackney Software.
Mitigation
The resolution for this vulnerability has been incorporated into version 1.24.0 of the product. It is crucial for users to upgrade their systems to this version or latently beyond to effectively safeguard against this vulnerability.
Acknowledgments
Special thanks are due to Michał Majchrowicz, Marcin Wyczechowski, and Paweł Zdunek from the Afine team for their responsible disclosure of the vulnerability, emphasizing the importance of collaboration in improving software security.
Additional Information
For more details regarding vulnerability disclosure processes coordinated by CERT Polska, visit CERT Polska.
In summary, CVE-2025-3864 represents a critical vulnerability in Hackney Software that could lead to serious service disruptions if not addressed. Stakeholders are encouraged to act promptly by updating to the latest version to maintain the security and integrity of their applications.