CVE-2026-47863 Spring CVE debrief

Who should care

Developers and administrators using Reactor Core versions 3.8.0 through 3.8.6 or 3.7.19 and earlier should review and update their installations to mitigate potential Denial of Service (DoS) attacks. This includes assessing the potential impact on their systems, reviewing the vendor's advisory, and planning for the implementation of compensating controls if necessary. Additionally, security teams and vulnerability management teams should be aware of the potential risks associated with this vulnerability and prioritize the remediation of affected systems.

Technical summary

A Denial of Service (DoS) condition exists in Reactor Core applications that use the Flux.bufferTimeout operator with fairBackpressure enabled. This affects Reactor Core versions 3.8.0 through 3.8.6 and 3.7.19 and earlier. The vulnerability is rated as MEDIUM with a CVSS score of 5.9. The issue arises from the improper handling of backpressure in the Flux.bufferTimeout operator, which can lead to a situation where the application becomes unresponsive or crashes, resulting in a Denial of Service.

Defensive priority

Medium-priority defensive review recommended due to potential Denial of Service (DoS) impact.

Recommended defensive actions

• Review and update Reactor Core versions to 3.8.7 or later, or 3.7.20 or later.
• Implement compensating controls to monitor and limit exposure to potential Denial of Service (DoS) attacks.
• Verify inventory of Reactor Core usage and assess potential impact.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

Evidence from official CVE Program record and NVD vulnerability detail indicate a Denial of Service (DoS) condition in Reactor Core applications using Flux.bufferTimeout operator with fairBackpressure enabled. Affected versions include Reactor Core 3.8.0 - 3.8.6 and 3.7.19 and earlier. The information provided by the CVE Program and NVD suggests that this vulnerability could potentially impact Reactor Core users, and it is recommended to review and update installations to mitigate potential Denial of Service (DoS) attacks. However, the extent of the impact and the specific conditions under which the vulnerability can be exploited are not fully detailed in the available sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.