Denial-of-Service (DoS)

Reactor Core is vulnerable to a Denial-of-Service DoS. The vulnerability is due to improper handling of backpressure when the Flux.bufferTimeout operator is used with fair backpressure enabled, which allows an attacker to trigger excessive resource consumption and potentially exhaust application...

EUVD-2026-66828

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863: Loop with Unreachable Exit Condition

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863

Reactor Core versions 3.8.0–3.8.6 and 3.7.19 and earlier are vulnerable to a Denial of Service condition in the Flux.bufferTimeout operator when fairBackpressure is enabled. The root cause is a race condition between flushing buffered items and the arrival of new upstream items during an active f...

CVE-2026-47863 Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

PT-2026-82357

Name of the Vulnerable Software and Affected Versions Reactor Core versions 3.0.0 through 3.7.19 Reactor Core versions 3.8.0 through 3.8.6 Description Applications using the Flux.bufferTimeout operator with fairBackpressure enabled are susceptible to a Denial of Service DoS condition. Fair...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the Flux.bufferTimeout process with fairBackpressure enabled when a race condition occurs between flushing buffered items and the arrival of new upstream items. An attacker can cause the stream to hang indefinitely and...