5.9Orta
CVE-2026-47857Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
Açıklama
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
Zayıflık türü (CWE):
CWE-190
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| broadcom | reactor core | < 3.4.42 | |
| Spring | Reactor Core | 3.8.0 – ≤ 3.8.6, 3.5.0 – ≤ 3.7.19, ≤ 3.4.41 |
Kaynaklar ve yamalar
- https://spring.io/security/cve-2026-47857 Vendor Advisory
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:*< 3.4.42cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:*≥ 3.5.0 < 3.7.20cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:*≥ 3.8.0 < 3.8.6.1