CVE-2026-47857
Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
CVE-2026-47857- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-66824
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
EUVD-2026-66824- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p9xf-3946-vr35
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure...
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
GHSA-p9xf-3946-vr35- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
CVE-2026-47857- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
CVE-2026-47857- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1791377112No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.18-tuxcare.1.
- Record
CLSA-2026-1791377112- Updated
- 2026-11-02
Show 24 moreShow less
OSVCLSA-2026-1791442790No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.6.4-tuxcare.1.
- Record
CLSA-2026-1791442790- Updated
- 2026-11-02
OSVCLSA-2026-1791442911No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.16-tuxcare.1.
- Record
CLSA-2026-1791442911- Updated
- 2026-11-02
OSVCLSA-2026-1791445468No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.13-tuxcare.1.
- Record
CLSA-2026-1791445468- Updated
- 2026-11-02
OSVCLSA-2026-1791446817No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.20-tuxcare.1.
- Record
CLSA-2026-1791446817- Updated
- 2026-11-02
OSVCLSA-2026-1791455070No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.6.3-tuxcare.1.
- Record
CLSA-2026-1791455070- Updated
- 2026-11-02
OSVCLSA-2026-1791457895No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.41-tuxcare.1.
- Record
CLSA-2026-1791457895- Updated
- 2026-11-02
OSVCLSA-2026-1791972789No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.5.8-tuxcare.1.
- Record
CLSA-2026-1791972789- Updated
- 2026-11-02
OSVCLSA-2026-1792056995No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.10-tuxcare.1.
- Record
CLSA-2026-1792056995- Updated
- 2026-11-02
OSVCLSA-2026-1792057279No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.14-tuxcare.1.
- Record
CLSA-2026-1792057279- Updated
- 2026-11-02
OSVCLSA-2026-1792076078No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.12-tuxcare.1.
- Record
CLSA-2026-1792076078- Updated
- 2026-11-02
OSVCLSA-2026-1792078057No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.6.0-tuxcare.1.
- Record
CLSA-2026-1792078057- Updated
- 2026-11-02
OSVCLSA-2026-1792080922No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.7.19-tuxcare.1.
- Record
CLSA-2026-1792080922- Updated
- 2026-11-02
OSVCLSA-2026-1792085546No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.9-tuxcare.1.
- Record
CLSA-2026-1792085546- Updated
- 2026-11-02
OSVCLSA-2026-1792146378No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.12-tuxcare.1.
- Record
CLSA-2026-1792146378- Updated
- 2026-11-02
OSVCLSA-2026-1792152610No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.10-tuxcare.1.
- Record
CLSA-2026-1792152610- Updated
- 2026-11-02
OSVCLSA-2026-1792155090No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.6-tuxcare.1.
- Record
CLSA-2026-1792155090- Updated
- 2026-11-02
OSVCLSA-2026-1792158950No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.7.14-tuxcare.1.
- Record
CLSA-2026-1792158950- Updated
- 2026-11-02
OSVCLSA-2026-1792164225No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.34-tuxcare.1.
- Record
CLSA-2026-1792164225- Updated
- 2026-11-02
OSVCLSA-2026-1792165022No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.17-tuxcare.1.
- Record
CLSA-2026-1792165022- Updated
- 2026-11-02
OSVCLSA-2026-1792395134No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.29-tuxcare.1.
- Record
CLSA-2026-1792395134- Updated
- 2026-11-02
OSVCLSA-2026-1792395135No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.32-tuxcare.1.
- Record
CLSA-2026-1792395135- Updated
- 2026-11-02
OSVCLSA-2026-1792395162No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.23-tuxcare.1.
- Record
CLSA-2026-1792395162- Updated
- 2026-11-02
OSVCLSA-2026-1792395647No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.22-tuxcare.1.
- Record
CLSA-2026-1792395647- Updated
- 2026-11-02
OSVCLSA-2026-1793730662No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.7.12-tuxcare.2.
- Record
CLSA-2026-1793730662- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.6.18 up to 3.6.18-tuxcare.1 | 3.6.18-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.6.4 up to 3.6.4-tuxcare.1 | 3.6.4-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.6.16 up to 3.6.16-tuxcare.1 | 3.6.16-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.6.13 up to 3.6.13-tuxcare.1 | 3.6.13-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.5.20 up to 3.5.20-tuxcare.1 | 3.5.20-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.6.3 up to 3.6.3-tuxcare.1 | 3.6.3-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.4.41 up to 3.4.41-tuxcare.1 | 3.4.41-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.5.8 up to 3.5.8-tuxcare.1 | 3.5.8-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.5.10 up to 3.5.10-tuxcare.1 | 3.5.10-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.5.14 up to 3.5.14-tuxcare.1 | 3.5.14-tuxcare.1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.5.12 up to 3.5.12-tuxcare.1 | 3.5.12-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.6.0 up to 3.6.0-tuxcare.1 | 3.6.0-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.7.19 up to 3.7.19-tuxcare.1 | 3.7.19-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.6.9 up to 3.6.9-tuxcare.1 | 3.6.9-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.6.12 up to 3.6.12-tuxcare.1 | 3.6.12-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.6.10 up to 3.6.10-tuxcare.1 | 3.6.10-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.6.6 up to 3.6.6-tuxcare.1 | 3.6.6-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.7.14 up to 3.7.14-tuxcare.1 | 3.7.14-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.4.34 up to 3.4.34-tuxcare.1 | 3.4.34-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.6.17 up to 3.6.17-tuxcare.1 | 3.6.17-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.4.29 up to 3.4.29-tuxcare.1 | 3.4.29-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.4.32 up to 3.4.32-tuxcare.1 | 3.4.32-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.4.23 up to 3.4.23-tuxcare.1 | 3.4.23-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.4.22 up to 3.4.22-tuxcare.1 | 3.4.22-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven | 3.7.12 up to 3.7.12-tuxcare.2, plus listed versions 3.7.12-tuxcare.1 | 3.7.12-tuxcare.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected, aliases, published, references | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47857 is a medium vulnerability (CVSS 5.9) in Broadcom Reactor Core, published August 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in io.projectreactor:reactor-core 3.6.4-tuxcare.1.