CVE-2026-47857 Security Details

CVE ID

CVE-2026-47857

CWE

CWE-190

CVE Description

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier

Published

Aug 21, 2026

CVSS Score & Severity

8.2High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.367%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

reactor/core/publisher/FluxWindowTimeout$WindowTimeoutWithBackpressureSubscriber.drain(JJ)V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT