Reactor Core DoS via Flux.windowTimeout fairBackpressure (3.8.6)
CVE-2026-47857 Published on August 26, 2026
Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.
Reactor Core 3.8.0 - 3.8.6
Reactor Core 3.5.0 - 3.7.19
Reactor Core 3.4.41 and earlier
Vulnerability Analysis
CVE-2026-47857 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Products Associated with CVE-2026-47857
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Reactor Core:- Version 3.8.0, <= 3.8.6 is affected.
- Version 3.5.0, <= 3.7.19 is affected.
- Before and including 3.4.41 is affected.