Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in Spring reactor-netty-core (CVE-2026-47857, CVE-2026-47863)

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in Spring reactor-netty-core, due to Integer Overflow and Infinite Loops. Spring reactor-netty-core is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

Security Bulletin: Security Vulnerability identified in reactor-core-3.7.11.jar used by IBM Maximo Application Suite - MREF

Summary There is a vulnerability in reactor-core-3.7.11.jar used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-47857 DESCRIPTION: In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Servic...

Security Bulletin: Multiple vulnerabilties in DevOps Test Hub

Summary Multiple vulnerabilities addressed in DevOps Test Hub in version 12.0.0 Vulnerability Details CVEID:CVE-2026-47857 DESCRIPTION: In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch release of NPS Vulnerability Details CVEID:CVE-2026-47857 DESCRIPTION: In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are...

io.projectreactor/reactor-core: Reactor Core: Denial of Service in bufferTimeout operator

A flaw was found in Reactor Core. Applications using the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. This occurs when upstream components deliver items during an active flush, causing the processing pipeline to permanently hang an...

Denial-of-Service (DoS)

Reactor Core is vulnerable to a Denial-of-Service DoS. The vulnerability is due to improper handling of backpressure when the Flux.bufferTimeout operator is used with fair backpressure enabled, which allows an attacker to trigger excessive resource consumption and potentially exhaust application...

EUVD-2026-66828

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863: Loop with Unreachable Exit Condition

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863 Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863 Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863

Reactor Core versions 3.8.0–3.8.6 and 3.7.19 and earlier are vulnerable to a Denial of Service condition in the Flux.bufferTimeout operator when fairBackpressure is enabled. The root cause is a race condition between flushing buffered items and the arrival of new upstream items during an active f...

PT-2026-82357

Name of the Vulnerable Software and Affected Versions Reactor Core versions 3.0.0 through 3.7.19 Reactor Core versions 3.8.0 through 3.8.6 Description Applications using the Flux.bufferTimeout operator with fairBackpressure enabled are susceptible to a Denial of Service DoS condition. Fair...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the Flux.bufferTimeout process with fairBackpressure enabled when a race condition occurs between flushing buffered items and the arrival of new upstream items. An attacker can cause the stream to hang indefinitely and...