CVE-2026-47857 Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier...

CVE-2026-47857 Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier...

CVE-2026-47857

Reactor Core is affected by a Denial of Service condition in the Flux.windowTimeout operator when fairBackpressure is enabled. The root cause is a 20-bit index wrap-around that can cause the stream to hang, leading to an availability impact with no confidentiality or integrity loss. Affected vers...

PT-2026-82352

Name of the Vulnerable Software and Affected Versions Reactor Core versions 3.8.0 through 3.8.6 Reactor Core versions 3.5.0 through 3.7.19 Reactor Core versions 3.4.41 and earlier Description Applications using the Flux.windowTimeout operator with fairBackpressure enabled are susceptible to a...

cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around...