5.9
Medium
CVE-2026-47857 In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a…
Description
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Reactor Core 3.8 | 3.8.0 → 3.8.6 | No fix stated |
| Reactor Core 3.5 | 3.5.0 → 3.7.19 | No fix stated |
| Reactor Core 3.4 | earliest → 3.4.41 | No fix stated |