EUVD-2026-66828

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47863

Reactor Core versions 3.8.0–3.8.6 and 3.7.19 and earlier are affected by a Denial of Service condition in the Flux.bufferTimeout operator when fair backpressure is enabled. The root cause is that if the upstream publisher delivers items during an active flush, the pipeline permanently hangs , ren...

PT-2026-82357

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...