{"id":"CVE-2026-47863","aliases":["CLSA-2026-1791377112","CLSA-2026-1791442911","CLSA-2026-1791445468","CLSA-2026-1791446817","CLSA-2026-1792056995","CLSA-2026-1792057279","CLSA-2026-1792063063","CLSA-2026-1792076078","CLSA-2026-1792080922","CLSA-2026-1792085546","CLSA-2026-1792146378","CLSA-2026-1792152610","CLSA-2026-1792155090","CLSA-2026-1792158950","CLSA-2026-1792165022","CLSA-2026-1793138070","CLSA-2026-1794232205","EUVD-2026-66828","GHSA-5jp2-w3vg-5w3x"],"status":"published","title":"Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush","description":"In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.7.19 and earlier","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00405,"percentile":0.35209,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-08-26T23:28:48Z","modified":"2026-11-09T19:15:10Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","fixed_in":["3.5.8-tuxcare.2","3.7.12-tuxcare.1","3.7.4-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.18"},{"fixed":"3.6.18-tuxcare.1"}]}],"versions":["3.6.18"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.16"},{"fixed":"3.6.16-tuxcare.1"}]}],"versions":["3.6.16"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.13"},{"fixed":"3.6.13-tuxcare.1"}]}],"versions":["3.6.13"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.20"},{"fixed":"3.5.20-tuxcare.1"}]}],"versions":["3.5.20"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.10"},{"fixed":"3.5.10-tuxcare.1"}]}],"versions":["3.5.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14"},{"fixed":"3.5.14-tuxcare.1"}]}],"versions":["3.5.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.8"},{"fixed":"3.5.8-tuxcare.2"}]}],"versions":["3.5.8","3.5.8-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.12"},{"fixed":"3.5.12-tuxcare.1"}]}],"versions":["3.5.12"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.19"},{"fixed":"3.7.19-tuxcare.1"}]}],"versions":["3.7.19"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.9"},{"fixed":"3.6.9-tuxcare.1"}]}],"versions":["3.6.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.12"},{"fixed":"3.6.12-tuxcare.1"}]}],"versions":["3.6.12"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.10"},{"fixed":"3.6.10-tuxcare.1"}]}],"versions":["3.6.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.6"},{"fixed":"3.6.6-tuxcare.1"}]}],"versions":["3.6.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.14"},{"fixed":"3.7.14-tuxcare.1"}]}],"versions":["3.7.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.17"},{"fixed":"3.6.17-tuxcare.1"}]}],"versions":["3.6.17"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.12"},{"fixed":"3.7.12-tuxcare.1"}]}],"versions":["3.7.12"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor:reactor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.4"},{"fixed":"3.7.4-tuxcare.1"}]}],"versions":["3.7.4"]}],"products":[{"vendor":"broadcom","product":"reactor_core"},{"vendor":"spring","product":"reactor core"}],"references":[{"url":"https://spring.io/security/cve-2026-47863","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47863","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5jp2-w3vg-5w3x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47863.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47863","title":"Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush","description":"In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.7.19 and earlier","status":"published","published":"2026-08-26T23:28:48.599Z","modified":"2026-08-27T14:45:41.473Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66828","description":"In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.7.19 and earlier","status":"published","published":"2026-08-26T23:28:48Z","modified":"2026-08-27T14:45:41Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:28.115205Z"}],"ghsa":[{"id":"GHSA-5jp2-w3vg-5w3x","title":"In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure...","description":"In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.7.19 and earlier","status":"published","published":"2026-08-27T03:32:58Z","modified":"2026-08-27T18:32:08Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:11:03.315113Z"}],"nvd":[{"id":"CVE-2026-47863","description":"In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.7.19 and earlier","status":"published","published":"2026-08-27T01:17:33.467Z","modified":"2026-09-01T23:51:07.06Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-47863","title":"Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush","description":"In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.7.19 and earlier","status":"published","published":"2026-08-26T23:28:48.599Z","modified":"2026-10-28T02:30:24.262465461Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"CLSA-2026-1791377112","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.18-tuxcare.1.","status":"published","published":"2026-10-07T12:45:12Z","modified":"2026-11-02T19:46:26.252082049Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791442911","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.16-tuxcare.1.","status":"published","published":"2026-10-08T07:01:51Z","modified":"2026-11-02T19:46:26.161719112Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1791445468","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.13-tuxcare.1.","status":"published","published":"2026-10-08T07:44:28Z","modified":"2026-11-02T19:46:26.268432328Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791446817","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.20-tuxcare.1.","status":"published","published":"2026-10-08T08:06:57Z","modified":"2026-11-02T19:46:26.270221513Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1792056995","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.10-tuxcare.1.","status":"published","published":"2026-10-15T09:36:35Z","modified":"2026-11-02T19:46:28.435175703Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792057279","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.14-tuxcare.1.","status":"published","published":"2026-10-15T09:41:19Z","modified":"2026-11-02T19:46:28.398268667Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792063063","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.5.8-tuxcare.2.","status":"published","published":"2026-10-15T11:17:43Z","modified":"2026-11-02T19:46:28.472819888Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792076078","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.5.12-tuxcare.1.","status":"published","published":"2026-10-15T14:54:38Z","modified":"2026-11-02T19:46:28.578669756Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792080922","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.7.19-tuxcare.1.","status":"published","published":"2026-10-15T16:15:22Z","modified":"2026-11-02T19:46:28.588511122Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792085546","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.9-tuxcare.1.","status":"published","published":"2026-10-15T17:32:26Z","modified":"2026-11-02T19:46:28.64321644Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792146378","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.12-tuxcare.1.","status":"published","published":"2026-10-16T10:26:18Z","modified":"2026-11-02T19:46:29.39167012Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792152610","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.10-tuxcare.1.","status":"published","published":"2026-10-16T12:10:10Z","modified":"2026-11-02T19:46:29.517507285Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792155090","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.6-tuxcare.1.","status":"published","published":"2026-10-16T12:51:30Z","modified":"2026-11-02T19:46:29.874628624Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792158950","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.7.14-tuxcare.1.","status":"published","published":"2026-10-16T13:55:50Z","modified":"2026-10-30T19:45:40.818035016Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792165022","title":"TuxCare security update for io.projectreactor:reactor-core (2 CVEs)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 2 CVEs. Fixed in 3.6.17-tuxcare.1.","status":"published","published":"2026-10-16T15:37:02Z","modified":"2026-11-02T19:46:30.154055808Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793138070","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.7.12-tuxcare.1.","status":"published","published":"2026-10-27T21:54:30Z","modified":"2026-11-02T19:46:32.693007137Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1794232205","title":"TuxCare security update for io.projectreactor:reactor-core (1 CVE)","description":"TuxCare rebuilt io.projectreactor:reactor-core to address 1 CVE. Fixed in 3.7.4-tuxcare.1.","status":"published","published":"2026-11-09T14:50:06Z","modified":"2026-11-09T19:15:10.628605938Z","updated_at":"2026-11-09T19:38:09.278998Z"}]}}