CVE-2026-47857

Reactor Core is affected by a Denial of Service condition in the Flux.windowTimeout operator when fairBackpressure is enabled. The root cause is a 20-bit index wrap-around that can cause the stream to hang, leading to an availability impact with no confidentiality or integrity loss. Affected vers...

CVE-2026-47863

Reactor Core versions 3.8.0–3.8.6 and 3.7.19 and earlier are vulnerable to a Denial of Service condition in the Flux.bufferTimeout operator when fairBackpressure is enabled. The root cause is a race condition between flushing buffered items and the arrival of new upstream items during an active f...