Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2026-47857

Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Reactor Core

Default version status: unaffected

  • 3.8.0 to ≤ 3.8.6affected
  • 3.5.0 to ≤ 3.7.19affected
  • 0 to ≤ 3.4.41affected

References