CVE-2026-47863

Reactor Core versions 3.8.0–3.8.6 and 3.7.19 and earlier are affected by a Denial of Service condition in the Flux.bufferTimeout operator when fair backpressure is enabled. The root cause is that if the upstream publisher delivers items during an active flush, the pipeline permanently hangs , ren...

cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush...

CVE-2026-4598

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values e.g.,...