CVE-2026-47863 Security Details

CVE ID

CVE-2026-47863

CWE

CWE-835

CVE Description

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier

Published

Aug 21, 2026

CVSS Score & Severity

7.5High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.405%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

reactor/core/publisher/FluxBufferTimeout$BufferTimeoutWithBackpressureSubscriber.drain(Z)V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT