CVE-2026-47863

Name of the Vulnerable Software and Affected Versions Reactor Core versions 3.0.0 through 3.7.19 Reactor Core versions 3.8.0 through 3.8.6

Description Applications using the Flux.bufferTimeout operator with fairBackpressure enabled are susceptible to a Denial of Service (DoS) condition. Fair backpressure is a mechanism used to ensure that multiple producers of data are handled equitably to prevent a single producer from dominating the processing pipeline.

Recommendations Update Reactor Core versions 3.0.0 through 3.7.19 to a version newer than 3.7.19. Update Reactor Core versions 3.8.0 through 3.8.6 to a version newer than 3.8.6. As a temporary mitigation, avoid using the Flux.bufferTimeout operator with fairBackpressure enabled.