CVE-2026-47857

Name of the Vulnerable Software and Affected Versions Reactor Core versions 3.8.0 through 3.8.6 Reactor Core versions 3.5.0 through 3.7.19 Reactor Core versions 3.4.41 and earlier

Description Applications using the Flux.windowTimeout operator with fairBackpressure enabled are susceptible to a Denial of Service (DoS) condition. Fair backpressure is a mechanism used to manage the flow of data between a producer and a consumer to prevent the consumer from being overwhelmed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.