What is GHSA-9fm9-hp7p-53mf?

GHSA-9fm9-hp7p-53mf is a security advisory published by GitHub Security Advisories with Low severity. Hackney fails to properly release HTTP connections to the pool

Which CVE IDs does GHSA-9fm9-hp7p-53mf cover?

GHSA-9fm9-hp7p-53mf covers the following CVE IDs: CVE-2025-3864. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-9fm9-hp7p-53mf?

GHSA-9fm9-hp7p-53mf affects 1 product, including: erlang/hackney:\u003c 1.24.0.

GHSA-9fm9-hp7p-53mfLow

Hackney fails to properly release HTTP connections to the pool

Vendor

GitHub Security Advisories

Published

May 28, 2025

Last Modified

January 29, 2026

🔗 CVE IDs covered (1)

CVE-2025-3864 →

📋 Description

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library. Fix for this issue has been included in 1.24.0 release.

🎯 Affected products1

erlang/hackney:< 1.24.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-3864
https://github.com/benoitc/hackney/issues/717
https://cert.pl/en/posts/2025/05/CVE-2025-3864
https://github.com/benoitc/hackney/commit/8f13ddac50d1626f8b9a47a08bd599e4efe1773d
https://github.com/advisories/GHSA-9fm9-hp7p-53mf