Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2026-47863

Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Reactor Core

Default version status: unaffected

  • 3.8.0 to ≤ 3.8.6affected
  • 0 to ≤ 3.7.19affected

References