Unknown · Reactor Core · CVE-2026-47863
**Name of the Vulnerable Software and Affected Versions**
Reactor Core versions 3.0.0 through 3.7.19
Reactor Core versions 3.8.0 through 3.8.6
**Description**
Applications using the `Flux.bufferTimeout` operator with fairBackpressure enabled are susceptible to a Denial of Service (DoS) condition. Fair backpressure is a mechanism used to ensure that multiple producers of data are handled equitably to prevent a single producer from dominating the processing pipeline.
**Recommendations**
Update Reactor Core versions 3.0.0 through 3.7.19 to a version newer than 3.7.19.
Update Reactor Core versions 3.8.0 through 3.8.6 to a version newer than 3.8.6.
As a temporary mitigation, avoid using the `Flux.bufferTimeout` operator with fairBackpressure enabled.