CVE-2026-47857 — Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - …
Published: 2026-08-26 · CVSS: 5.9 · CVSS 3.1
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7