CVE-2026-47857 - Vulnerability Details - OpenCVE

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Spring	Reactor Core

No data.

No data.

References

Link	Providers
https://spring.io/security/cve-2026-47857

History

Tue, 01 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spring Spring reactor Core
Vendors & Products		Spring Spring reactor Core

Thu, 27 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-682

Thu, 27 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 27 Aug 2026 01:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-682

Thu, 27 Aug 2026 00:30:00 +0000

Type	Values Removed	Values Added
Description		In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
Title		Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
References		https://spring.io/security/cve-2026-47857
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2026-08-26T23:28:44.743Z

Updated: 2026-08-27T15:07:38.775Z

Reserved: 2026-05-20T10:00:55.156Z

Link: CVE-2026-47857

Vulnrichment

Updated: 2026-08-27T15:07:08.808Z

NVD

Status : Awaiting Analysis

Published: 2026-08-27T01:17:32.687

Modified: 2026-08-28T18:47:30.163

Link: CVE-2026-47857

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47857", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-05-20T10:00:55.156Z", "datePublished": "2026-08-26T23:28:44.743Z", "dateUpdated": "2026-08-27T15:07:38.775Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-26T23:28:44.743Z"}, "title": "Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-190 Integer Overflow or Wraparound", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition."}]}], "affected": [{"vendor": "Spring", "product": "Reactor Core", "versions": [{"status": "affected", "version": "3.8.0", "lessThanOrEqual": "3.8.6", "versionType": "custom"}, {"status": "affected", "version": "3.5.0", "lessThanOrEqual": "3.7.19", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThanOrEqual": "3.4.41", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.</p><p>Reactor Core 3.8.0 - 3.8.6<br/>Reactor Core 3.5.0 - 3.7.19<br/>Reactor Core 3.4.41 and earlier</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-47857"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-27T15:07:04.132397Z", "id": "CVE-2026-47857", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T15:07:38.775Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47857", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T15:07:04.132397Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T15:07:08.808Z"}}], "cna": {"title": "Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Reactor Core", "versions": [{"status": "affected", "version": "3.8.0", "versionType": "custom", "lessThanOrEqual": "3.8.6"}, {"status": "affected", "version": "3.5.0", "versionType": "custom", "lessThanOrEqual": "3.7.19"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.4.41"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-47857"}], "descriptions": [{"lang": "en", "value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier", "supportingMedia": [{"type": "text/html", "value": "<p>In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.</p><p>Reactor Core 3.8.0 - 3.8.6<br/>Reactor Core 3.5.0 - 3.7.19<br/>Reactor Core 3.4.41 and earlier</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-26T23:28:44.743Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47857", "state": "PUBLISHED", "dateUpdated": "2026-08-27T15:07:38.775Z", "dateReserved": "2026-05-20T10:00:55.156Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-08-26T23:28:44.743Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}