5.9Mittel
CVE-2026-47863Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
Beschreibung
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier
Schwachstellentyp (CWE):
CWE-835
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| broadcom | reactor core | 3.5.7 – < 3.7.20 | |
| Spring | Reactor Core | 3.8.0 – ≤ 3.8.6, ≤ 3.7.19 |
Referenzen und Patches
- https://spring.io/security/cve-2026-47863 Vendor Advisory
CPE-Treffer (NVD) (2)
cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:*≥ 3.5.7 < 3.7.20cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:*≥ 3.8.0 < 3.8.6.1