PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47857 Spring CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-27T01:17:32.687Z and has not been modified since then. Reactor Core applications using the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Affected versions include Reactor Core 3.8.0 - 3.8.6, 3.5.0 - 3.7.19, and 3.4.41 and earlier. The vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. This CVE record indicates potential service disruption due to DoS. Limited source detail suggests verifying inventory and applying patches. Evidence from official CVE Program record and NVD vulnerability detail page indicates Reactor Core applications using Flux.windowTimeout with fairBackpressure enabled are vulnerable to DoS.

Vendor
Spring
Product
Reactor Core
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-27
Original CVE updated
2026-09-04
Advisory published
2026-08-27
Advisory updated
2026-09-04

Who should care

Developers and administrators using Reactor Core, especially those using the Flux.windowTimeout operator with fairBackpressure enabled, should review and update to a non-vulnerable version to prevent potential DoS impact. Security teams and vulnerability management teams should also review and assess the risk of Reactor Core deployments in their environments. Additionally, operators and platform administrators may need to verify inventory and apply patches or mitigations as needed. Security teams should prioritize review of Reactor Core usage and ensure compensating controls are in place for exposed systems.

Technical summary

Reactor Core applications using the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Affected versions include Reactor Core 3.8.0 - 3.8.6, 3.5.0 - 3.7.19, and 3.4.41 and earlier. The vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. Technical impact includes potential service disruption due to DoS.

Defensive priority

Medium-priority defensive review recommended due to potential Denial of Service (DoS) impact.

Recommended defensive actions

  • Review and update Reactor Core to a non-vulnerable version if using affected versions.
  • Implement compensating controls to monitor and limit potential DoS impact.
  • Verify inventory of Reactor Core usage and apply necessary patches.
  • Perform exposure review for Reactor Core deployments.
  • Monitor for potential DoS impact on Reactor Core systems.

Evidence notes

Evidence from official CVE Program record and NVD vulnerability detail page indicates Reactor Core applications using Flux.windowTimeout with fairBackpressure enabled are vulnerable to DoS. Affected versions include Reactor Core 3.8.0 - 3.8.6, 3.5.0 - 3.7.19, and 3.4.41 and earlier. Limited source detail suggests verifying inventory and applying patches, with evidence grounding from CVE Program and NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47857 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47857

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47857 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47857

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.