Denial-of-Service (DoS)

Reactor Core is vulnerable to a Denial-of-Service DoS. The vulnerability is due to improper handling of the Flux.windowTimeout operator when fairBackpressure is enabled, which allows an attacker to trigger excessive resource consumption and potentially exhaust application resources...

CVE-2026-47857

A flaw was found in Reactor Core. A remote attacker could exploit this vulnerability by using the Flux.windowTimeout operator with fairBackpressure enabled, leading to a Denial of Service DoS condition. This could cause applications to become unresponsive or crash. Mitigation Mitigation for this...

EUVD-2026-66824

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier...

CVE-2026-47857

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier...

CVE-2026-47857: Integer Overflow or Wraparound

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Flux.windowTimeout function when fairBackpressure is enabled. An attacker can cause the stream to hang indefinitely and exhaust system resources by maintaining long-lived...