CVE-2026-47863 — Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active…

CVE-2026-47863

Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush PUBLISHED

Description (CNA)

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Reactor Core	affected 3.8.0 through 3.8.6; affected 0 through 3.7.19

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47863

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.