CVE-2026-47857: Reactor Core DoS Vulnerability

CVE-2026-47857 Overview

CVE-2026-47857 is a Denial of Service (DoS) vulnerability in Reactor Core, the reactive streams foundation used by Spring WebFlux and other reactive Java applications. The flaw affects applications that use the Flux.windowTimeout operator with fairBackpressure enabled. Under specific conditions, the operator can enter a state that consumes excessive resources and degrades application availability.

Affected versions include Reactor Core 3.8.0 through 3.8.6, 3.5.0 through 3.7.19, and 3.4.41 and earlier. The issue was disclosed through a Spring Security Advisory for CVE-2026-47857.

Critical Impact
Remote attackers can trigger sustained resource exhaustion in reactive Java services that expose endpoints backed by Flux.windowTimeout with fairBackpressure, causing availability loss.

Affected Products

Reactor Core 3.8.0 through 3.8.6
Reactor Core 3.5.0 through 3.7.19
Reactor Core 3.4.41 and earlier

Discovery Timeline

2026-08-27 - CVE-2026-47857 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47857

Vulnerability Analysis

The vulnerability resides in the Flux.windowTimeout operator when configured with fairBackpressure enabled. This operator partitions an upstream Flux into time-bounded or size-bounded windows and, in fair-backpressure mode, coordinates demand between the producer and downstream subscribers.

Under crafted timing or backpressure conditions, the coordination logic fails to bound its internal state or work, leading to resource exhaustion. A remote client that controls the rate or shape of input to a reactive endpoint can drive the operator into this pathological state without authentication.

Successful exploitation results in an availability impact only; confidentiality and integrity are not affected. Attack complexity is elevated because the attacker must produce input patterns that reach and stress the affected operator path.

Root Cause

The root cause is unbounded or improperly bounded resource use inside the fairBackpressure branch of Flux.windowTimeout. The operator's demand accounting and window transitions do not adequately constrain internal buffering or scheduling under adversarial input, matching the pattern of an algorithmic Denial of Service defect.

Attack Vector

The attack vector is network-based. Any application that exposes a reactive pipeline built on Flux.windowTimeout(..., fairBackpressure=true) and forwards untrusted input into that pipeline is reachable by unauthenticated remote attackers. Typical exposure points include Spring WebFlux HTTP handlers, RSocket endpoints, and message-broker consumers that feed the operator.

No verified public exploit code is available. Technical details are described in prose only; see the Spring Security Advisory for CVE-2026-47857 for vendor guidance.

Detection Methods for CVE-2026-47857

Indicators of Compromise

Sustained high CPU or heap usage in JVM processes running Reactor Core, correlated with traffic to reactive endpoints.
Growing thread pool queues or Reactor scheduler backlog with no corresponding increase in successful responses.
Increased request latency or timeouts on endpoints that internally use Flux.windowTimeout with fairBackpressure.

Detection Strategies

Inventory application code and dependencies for calls to Flux.windowTimeout with the fairBackpressure parameter set to true.
Perform Software Composition Analysis (SCA) to flag Reactor Core versions 3.4.41 and earlier, 3.5.0 through 3.7.19, and 3.8.0 through 3.8.6.
Review reactive endpoints for untrusted input paths that reach the affected operator without upstream rate limiting.

Monitoring Recommendations

Instrument Reactor metrics via Micrometer to track window operator throughput, subscription counts, and pending demand.
Alert on abnormal JVM garbage collection pressure, thread starvation, and Netty event-loop stalls on WebFlux services.
Correlate application performance metrics with request source IPs and payload patterns to identify abusive clients.

How to Mitigate CVE-2026-47857

Immediate Actions Required

Upgrade Reactor Core to a fixed release above 3.8.6, above 3.7.19 in the 3.7.x line, or above 3.4.41 in the 3.4.x line, as identified in the vendor advisory.
Audit application source for Flux.windowTimeout usage and confirm whether fairBackpressure is enabled.
Apply rate limiting and request size limits at the ingress layer for reactive endpoints exposed to untrusted networks.

Patch Information

Review the Spring Security Advisory for CVE-2026-47857 for the exact patched Reactor Core versions and upgrade guidance. Applications using Spring Boot should update to a Spring Boot release that pulls in a fixed Reactor Core version via managed dependencies rather than overriding versions manually.

Workarounds

Where feasible, disable fairBackpressure on Flux.windowTimeout and use the default backpressure mode until upgrading.
Replace Flux.windowTimeout with alternative windowing operators such as Flux.window or Flux.buffer where semantics allow.
Place a reverse proxy or API gateway in front of reactive services to enforce concurrency and request-rate ceilings.

bash

# Example Maven dependency override to pin a fixed Reactor Core version
# Replace <FIXED_VERSION> with the patched release from the Spring advisory
mvn dependency:tree | grep reactor-core
./mvnw -Dreactor-bom.version=<FIXED_VERSION> -U clean verify