CVE-2026-47857: Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
Published Aug 26, 2026
·Updated
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier
Affected Software
3 affected components
Reactor Reactor Core>=3.8.0<=3.8.6
Reactor Reactor Core>=3.5.0<=3.7.19
Reactor Reactor Core<=3.4.41
Event History
Aug 26, 2026
CVE Published
via MITRE·11:28 PM
Data Sourced
via MITRE·11:28 PM
DescriptionSeverityWeakness
Aug 27, 2026
Data Sourced
via NVD·01:17 AM
DescriptionSeverity
Frequently Asked Questions
1
Which deployments are affected?
Affected deployments use Reactor Core's Flux.windowTimeout operator with fairBackpressure enabled. The affected release ranges are 3.8.0 through 3.8.6, 3.5.0 through 3.7.19, and 3.4.41 and earlier.
2
What access does an attacker need?
The severity vector indicates the issue is reachable over the network and requires no privileges or user interaction. Exploitation has high attack complexity, and the stated impact is denial of service rather than confidentiality or integrity loss.