{"id":"CVE-2026-47857","aliases":["CLSA-2026-1791377112","CLSA-2026-1791442790","CLSA-2026-1791442911","CLSA-2026-1791445468","CLSA-2026-1791446817","CLSA-2026-1791455070","CLSA-2026-1791457895","CLSA-2026-1791972789","CLSA-2026-1792056995","CLSA-2026-1792057279","CLSA-2026-1792076078","CLSA-2026-1792078057","CLSA-2026-1792080922","CLSA-2026-1792085546","CLSA-2026-1792146378","CLSA-2026-1792152610","CLSA-2026-1792155090","CLSA-2026-1792158950","CLSA-2026-1792164225","CLSA-2026-1792165022","CLSA-2026-1792395134","CLSA-2026-1792395135","CLSA-2026-1792395162","CLSA-2026-1792395647","CLSA-2026-1793730662","EUVD-2026-66824","GHSA-p9xf-3946-vr35"],"status":"published","title":"Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around","description":"In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00367,"percentile":0.30795,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-08-26T23:28:44Z","modified":"2026-11-04T02:30:03Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","fixed_in":["3.6.4-tuxcare.1","3.6.3-tuxcare.1","3.4.41-tuxcare.1","3.5.8-tuxcare.1","3.6.0-tuxcare.1","3.4.34-tuxcare.1","3.4.29-tuxcare.1","3.4.32-tuxcare.1","3.4.23-tuxcare.1","3.4.22-tuxcare.1","3.7.12-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.18"},{"fixed":"3.6.18-tuxcare.1"}]}],"versions":["3.6.18"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.4"},{"fixed":"3.6.4-tuxcare.1"}]}],"versions":["3.6.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.16"},{"fixed":"3.6.16-tuxcare.1"}]}],"versions":["3.6.16"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.13"},{"fixed":"3.6.13-tuxcare.1"}]}],"versions":["3.6.13"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.20"},{"fixed":"3.5.20-tuxcare.1"}]}],"versions":["3.5.20"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.3"},{"fixed":"3.6.3-tuxcare.1"}]}],"versions":["3.6.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.41"},{"fixed":"3.4.41-tuxcare.1"}]}],"versions":["3.4.41"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.8"},{"fixed":"3.5.8-tuxcare.1"}]}],"versions":["3.5.8"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.10"},{"fixed":"3.5.10-tuxcare.1"}]}],"versions":["3.5.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14"},{"fixed":"3.5.14-tuxcare.1"}]}],"versions":["3.5.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.12"},{"fixed":"3.5.12-tuxcare.1"}]}],"versions":["3.5.12"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.0-tuxcare.1"}]}],"versions":["3.6.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.19"},{"fixed":"3.7.19-tuxcare.1"}]}],"versions":["3.7.19"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.9"},{"fixed":"3.6.9-tuxcare.1"}]}],"versions":["3.6.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.12"},{"fixed":"3.6.12-tuxcare.1"}]}],"versions":["3.6.12"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.10"},{"fixed":"3.6.10-tuxcare.1"}]}],"versions":["3.6.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.6"},{"fixed":"3.6.6-tuxcare.1"}]}],"versions":["3.6.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.14"},{"fixed":"3.7.14-tuxcare.1"}]}],"versions":["3.7.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.34"},{"fixed":"3.4.34-tuxcare.1"}]}],"versions":["3.4.34"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.17"},{"fixed":"3.6.17-tuxcare.1"}]}],"versions":["3.6.17"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.29"},{"fixed":"3.4.29-tuxcare.1"}]}],"versions":["3.4.29"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.32"},{"fixed":"3.4.32-tuxcare.1"}]}],"versions":["3.4.32"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.23"},{"fixed":"3.4.23-tuxcare.1"}]}],"versions":["3.4.23"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.22"},{"fixed":"3.4.22-tuxcare.1"}]}],"versions":["3.4.22"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.12"},{"fixed":"3.7.12-tuxcare.2"}]}],"versions":["3.7.12","3.7.12-tuxcare.1"]}],"products":[{"vendor":"broadcom","product":"reactor_core"},{"vendor":"spring","product":"reactor core"}],"references":[{"url":"https://spring.io/security/cve-2026-47857","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47857","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p9xf-3946-vr35"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47857.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47857","title":"Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around","description":"In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier","status":"published","published":"2026-08-26T23:28:44.743Z","modified":"2026-08-27T15:07:38.775Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T13:36:29.327819Z"}],"euvd":[{"id":"EUVD-2026-66824","description":"In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier","status":"published","published":"2026-08-26T23:28:44Z","modified":"2026-08-27T15:07:38Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:27.663452Z"}],"ghsa":[{"id":"GHSA-p9xf-3946-vr35","title":"In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure...","description":"In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier","status":"published","published":"2026-08-27T03:32:58Z","modified":"2026-08-27T18:32:07Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:11:03.315113Z"}],"nvd":[{"id":"CVE-2026-47857","description":"In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier","status":"published","published":"2026-08-27T01:17:32.687Z","modified":"2026-09-04T20:10:22.583Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-47857","title":"Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around","description":"In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier","status":"published","published":"2026-08-26T23:28:44.743Z","modified":"2026-10-28T02:31:14.460148426Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"CLSA-2026-1791377112","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.18-tuxcare.1.","status":"published","published":"2026-10-07T12:45:12Z","modified":"2026-11-02T19:46:26.252082049Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791442790","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.6.4-tuxcare.1.","status":"published","published":"2026-10-08T06:59:50Z","modified":"2026-10-30T19:45:38.100011328Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791442911","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.16-tuxcare.1.","status":"published","published":"2026-10-08T07:01:51Z","modified":"2026-11-02T19:46:26.161719112Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1791445468","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.13-tuxcare.1.","status":"published","published":"2026-10-08T07:44:28Z","modified":"2026-11-02T19:46:26.268432328Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791446817","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.20-tuxcare.1.","status":"published","published":"2026-10-08T08:06:57Z","modified":"2026-11-02T19:46:26.270221513Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791455070","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.6.3-tuxcare.1.","status":"published","published":"2026-10-08T10:24:30Z","modified":"2026-11-02T19:46:26.840727559Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791457895","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.41-tuxcare.1.","status":"published","published":"2026-10-08T11:11:35Z","modified":"2026-11-02T19:46:26.909292965Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791972789","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.5.8-tuxcare.1.","status":"published","published":"2026-10-14T10:13:09Z","modified":"2026-11-02T19:46:27.483598397Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792056995","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.10-tuxcare.1.","status":"published","published":"2026-10-15T09:36:35Z","modified":"2026-11-02T19:46:28.435175703Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792057279","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.14-tuxcare.1.","status":"published","published":"2026-10-15T09:41:19Z","modified":"2026-11-02T19:46:28.398268667Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792076078","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.12-tuxcare.1.","status":"published","published":"2026-10-15T14:54:38Z","modified":"2026-11-02T19:46:28.578669756Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792078057","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.6.0-tuxcare.1.","status":"published","published":"2026-10-15T15:27:37Z","modified":"2026-11-02T19:46:28.667499897Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792080922","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.7.19-tuxcare.1.","status":"published","published":"2026-10-15T16:15:22Z","modified":"2026-11-02T19:46:28.588511122Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792085546","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.9-tuxcare.1.","status":"published","published":"2026-10-15T17:32:26Z","modified":"2026-11-02T19:46:28.64321644Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792146378","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.12-tuxcare.1.","status":"published","published":"2026-10-16T10:26:18Z","modified":"2026-11-02T19:46:29.39167012Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792152610","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.10-tuxcare.1.","status":"published","published":"2026-10-16T12:10:10Z","modified":"2026-11-02T19:46:29.517507285Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792155090","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.6-tuxcare.1.","status":"published","published":"2026-10-16T12:51:30Z","modified":"2026-11-02T19:46:29.874628624Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792158950","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.7.14-tuxcare.1.","status":"published","published":"2026-10-16T13:55:50Z","modified":"2026-10-30T19:45:40.818035016Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792164225","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.34-tuxcare.1.","status":"published","published":"2026-10-16T15:23:45Z","modified":"2026-11-02T19:46:29.53284639Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792165022","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.17-tuxcare.1.","status":"published","published":"2026-10-16T15:37:02Z","modified":"2026-11-02T19:46:30.154055808Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792395134","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.29-tuxcare.1.","status":"published","published":"2026-10-19T07:32:14Z","modified":"2026-11-02T19:46:29.579209388Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792395135","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.32-tuxcare.1.","status":"published","published":"2026-10-19T07:32:15Z","modified":"2026-11-02T19:46:29.675220248Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792395162","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.23-tuxcare.1.","status":"published","published":"2026-10-19T07:32:42Z","modified":"2026-11-02T19:46:29.601076416Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792395647","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.4.22-tuxcare.1.","status":"published","published":"2026-10-19T07:40:47Z","modified":"2026-11-02T19:46:29.537964546Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1793730662","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.7.12-tuxcare.2.","status":"published","published":"2026-11-03T19:31:03Z","modified":"2026-11-04T02:30:03.524494951Z","updated_at":"2026-11-04T02:55:01.518827Z"}]}}