Описание
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
Отчет
This vulnerability is rated Moderate for Red Hat Build of Quarkus. When an application built with Quarkus 3.27 uses Hibernate Reactive and exposes an HTTP endpoint for database operations, a remote client can cause an application level denial of service by prematurely closing the HTTP connection, leading to database connection pool exhaustion. Other Red Hat products, including Enterprise Application Platform and Red Hat OpenShift Dev Spaces, are not affected as the vulnerable code is not present.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Enterprise Application Platform 8 | hibernate-reactive-core | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | quarkus-hibernate-reactive-panache | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | hibernate-reactive-core | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | quarkus-hibernate-reactive-panache | Not affected | ||
| Red Hat OpenShift Dev Spaces | devspaces/dashboard-rhel9 | Not affected | ||
| Red Hat OpenShift Dev Spaces | devspaces/devspaces-operator-bundle | Not affected | ||
| Red Hat build of Quarkus 3.27.2 | hibernate-reactive-core | Fixed | RHSA-2026:1965 | 05.02.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.
Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion
EPSS
4.3 Medium
CVSS3