CVE-2026-47857
Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
CVE-2026-47857- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-66824
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
EUVD-2026-66824- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p9xf-3946-vr35
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure...
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
GHSA-p9xf-3946-vr35- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
CVE-2026-47857- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
- Record
CVE-2026-47857- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1791377112 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.18-tuxcare.1.
- Record
CLSA-2026-1791377112- Updated
- 2026-11-02
Show 24 moreShow less
OSVCLSA-2026-1791442790 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.6.4-tuxcare.1.
- Record
CLSA-2026-1791442790- Updated
- 2026-11-02
OSVCLSA-2026-1791442911 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.16-tuxcare.1.
- Record
CLSA-2026-1791442911- Updated
- 2026-11-02
OSVCLSA-2026-1791445468 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.13-tuxcare.1.
- Record
CLSA-2026-1791445468- Updated
- 2026-11-02
OSVCLSA-2026-1791446817 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.20-tuxcare.1.
- Record
CLSA-2026-1791446817- Updated
- 2026-11-02
OSVCLSA-2026-1791455070 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.6.3-tuxcare.1.
- Record
CLSA-2026-1791455070- Updated
- 2026-11-02
OSVCLSA-2026-1791457895 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.41-tuxcare.1.
- Record
CLSA-2026-1791457895- Updated
- 2026-11-02
OSVCLSA-2026-1791972789 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.5.8-tuxcare.1.
- Record
CLSA-2026-1791972789- Updated
- 2026-11-02
OSVCLSA-2026-1792056995 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.10-tuxcare.1.
- Record
CLSA-2026-1792056995- Updated
- 2026-11-02
OSVCLSA-2026-1792057279 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.14-tuxcare.1.
- Record
CLSA-2026-1792057279- Updated
- 2026-11-02
OSVCLSA-2026-1792076078 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.12-tuxcare.1.
- Record
CLSA-2026-1792076078- Updated
- 2026-11-02
OSVCLSA-2026-1792078057 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.6.0-tuxcare.1.
- Record
CLSA-2026-1792078057- Updated
- 2026-11-02
OSVCLSA-2026-1792080922 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.7.19-tuxcare.1.
- Record
CLSA-2026-1792080922- Updated
- 2026-11-02
OSVCLSA-2026-1792085546 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.9-tuxcare.1.
- Record
CLSA-2026-1792085546- Updated
- 2026-11-02
OSVCLSA-2026-1792146378 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.12-tuxcare.1.
- Record
CLSA-2026-1792146378- Updated
- 2026-11-02
OSVCLSA-2026-1792152610 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.10-tuxcare.1.
- Record
CLSA-2026-1792152610- Updated
- 2026-11-02
OSVCLSA-2026-1792155090 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.6-tuxcare.1.
- Record
CLSA-2026-1792155090- Updated
- 2026-11-02
OSVCLSA-2026-1792158950 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.7.14-tuxcare.1.
- Record
CLSA-2026-1792158950- Updated
- 2026-11-02
OSVCLSA-2026-1792164225 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.34-tuxcare.1.
- Record
CLSA-2026-1792164225- Updated
- 2026-11-02
OSVCLSA-2026-1792165022 No score
TuxCare security update for io.projectreactor:reactor-core (2 CVEs)
TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.17-tuxcare.1.
- Record
CLSA-2026-1792165022- Updated
- 2026-11-02
OSVCLSA-2026-1792395134 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.29-tuxcare.1.
- Record
CLSA-2026-1792395134- Updated
- 2026-11-02
OSVCLSA-2026-1792395135 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.32-tuxcare.1.
- Record
CLSA-2026-1792395135- Updated
- 2026-11-02
OSVCLSA-2026-1792395162 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.23-tuxcare.1.
- Record
CLSA-2026-1792395162- Updated
- 2026-11-02
OSVCLSA-2026-1792395647 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.22-tuxcare.1.
- Record
CLSA-2026-1792395647- Updated
- 2026-11-02
OSVCLSA-2026-1793730662 No score
TuxCare security update for io.projectreactor:reactor-core (1 CVE)
TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.7.12-tuxcare.2.
- Record
CLSA-2026-1793730662- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.6.18 up to 3.6.18-tuxcare.1 | 3.6.18-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.6.4 up to 3.6.4-tuxcare.1 | 3.6.4-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.6.16 up to 3.6.16-tuxcare.1 | 3.6.16-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.6.13 up to 3.6.13-tuxcare.1 | 3.6.13-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.5.20 up to 3.5.20-tuxcare.1 | 3.5.20-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.6.3 up to 3.6.3-tuxcare.1 | 3.6.3-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.4.41 up to 3.4.41-tuxcare.1 | 3.4.41-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.5.8 up to 3.5.8-tuxcare.1 | 3.5.8-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.5.10 up to 3.5.10-tuxcare.1 | 3.5.10-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.5.14 up to 3.5.14-tuxcare.1 | 3.5.14-tuxcare.1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.5.12 up to 3.5.12-tuxcare.1 | 3.5.12-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.6.0 up to 3.6.0-tuxcare.1 | 3.6.0-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.7.19 up to 3.7.19-tuxcare.1 | 3.7.19-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.6.9 up to 3.6.9-tuxcare.1 | 3.6.9-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.6.12 up to 3.6.12-tuxcare.1 | 3.6.12-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.6.10 up to 3.6.10-tuxcare.1 | 3.6.10-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.6.6 up to 3.6.6-tuxcare.1 | 3.6.6-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.7.14 up to 3.7.14-tuxcare.1 | 3.7.14-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.4.34 up to 3.4.34-tuxcare.1 | 3.4.34-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.6.17 up to 3.6.17-tuxcare.1 | 3.6.17-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.4.29 up to 3.4.29-tuxcare.1 | 3.4.29-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.4.32 up to 3.4.32-tuxcare.1 | 3.4.32-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.4.23 up to 3.4.23-tuxcare.1 | 3.4.23-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.4.22 up to 3.4.22-tuxcare.1 | 3.4.22-tuxcare.1 |
io.projectreactor:reactor-coreTuxCare:Maven |
3.7.12 up to 3.7.12-tuxcare.2, plus listed versions 3.7.12-tuxcare.1 |
3.7.12-tuxcare.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected, aliases, published, references | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47857 is a medium vulnerability (CVSS 5.9) in Broadcom Reactor Core, published August 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in io.projectreactor:reactor-core 3.6.4-tuxcare.1.