CVE-2026-47863 Overview
CVE-2026-47863 is a Denial of Service (DoS) vulnerability in Reactor Core, the reactive streams library that underpins the Spring WebFlux stack. Applications that use the Flux.bufferTimeout operator with fairBackpressure enabled can be driven into an unrecoverable state by a remote attacker. The flaw affects Reactor Core versions 3.8.0 through 3.8.6 and Reactor Core 3.7.19 and earlier. Exploitation requires no authentication and no user interaction, though attack complexity is high. Successful exploitation impacts availability only; confidentiality and integrity remain intact.
Critical Impact
Remote, unauthenticated attackers can trigger a Denial of Service in applications built on Reactor Core when Flux.bufferTimeout is used with fairBackpressure enabled.
Affected Products
- Reactor Core 3.8.0 through 3.8.6
- Reactor Core 3.7.19 and earlier
- Downstream applications using Flux.bufferTimeout with fairBackpressure enabled
Discovery Timeline
- 2026-08-27 - CVE-2026-47863 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-47863
Vulnerability Analysis
Reactor Core provides the Flux.bufferTimeout operator to collect emitted items into buffers based on size and elapsed time. The fairBackpressure variant introduces additional coordination between the upstream producer, an internal queue, and the downstream subscriber to honor demand requests fairly. The vulnerability arises in this coordination path when the operator processes streams under specific timing and demand conditions. An attacker who can influence the rate or pattern of upstream events can push the operator into a state where it consumes resources without producing downstream progress, exhausting availability for legitimate consumers. Because Reactor Core sits beneath Spring WebFlux, the affected surface commonly includes reactive HTTP endpoints, message brokers, and streaming APIs. The advisory categorizes the issue as a resource-exhaustion Denial of Service [CWE-400].
Root Cause
The root cause is a flaw in the fair backpressure implementation of Flux.bufferTimeout. Under adversarial input timing, the operator's internal state machine fails to converge, resulting in resource exhaustion within the reactive pipeline. Only the fair-backpressure variant is impacted; the standard bufferTimeout overloads are not implicated.
Attack Vector
The attack vector is network-based. An unauthenticated remote attacker sends crafted request patterns to an application that pipes network input through Flux.bufferTimeout(maxSize, timespan, true) or an equivalent fair-backpressure configuration. High attack complexity reflects the timing sensitivity required to force the operator into the failing state. Refer to the Spring Security Advisory for CVE-2026-47863 for technical details on the affected code paths.
Detection Methods for CVE-2026-47863
Indicators of Compromise
- Sustained high CPU or memory usage in JVM processes hosting Reactor Core pipelines without a corresponding increase in successful downstream throughput.
- Reactive endpoints becoming unresponsive while thread pools and event loops remain busy on bufferTimeout internal operations.
- Growing queue depth or backlog metrics on reactive streams that use Flux.bufferTimeout with fairBackpressure.
Detection Strategies
- Perform a dependency inventory to identify applications shipping Reactor Core 3.7.19 and earlier or 3.8.0 through 3.8.6.
- Statically scan source and bytecode for invocations of Flux.bufferTimeout where the fairBackpressure parameter is set to true.
- Correlate application response-time degradation with request patterns targeting reactive streaming endpoints.
Monitoring Recommendations
- Instrument reactive pipelines with Micrometer metrics for buffer size, subscriber demand, and operator latency.
- Alert on reactive endpoints whose 95th-percentile latency diverges from baseline while request volume remains constant.
- Capture JVM thread dumps and heap snapshots when reactive services become unresponsive to confirm operator-level stalls.
How to Mitigate CVE-2026-47863
Immediate Actions Required
- Upgrade Reactor Core to a fixed release above 3.8.6 in the 3.8.x branch or to a patched version above 3.7.19 in the 3.7.x branch as published in the Spring Security Advisory for CVE-2026-47863.
- Audit all reactive code paths for use of Flux.bufferTimeout with fairBackpressure enabled and prioritize their remediation.
- Apply rate limiting and request validation on reactive endpoints exposed to untrusted networks until patched versions are deployed.
Patch Information
Pivotal/VMware has published fixes through the Spring release channel. Consult the Spring Security Advisory for CVE-2026-47863 for the exact fixed Reactor Core versions and coordinated Spring Framework, Spring Boot, and Spring Cloud release trains that bundle the update.
Workarounds
- Disable fair backpressure by switching affected calls to a Flux.bufferTimeout overload that does not enable fairBackpressure.
- Restructure pipelines to use alternative operators such as buffer(Duration) combined with explicit backpressure strategies where semantics allow.
- Place a reverse proxy or API gateway in front of reactive services to enforce concurrency limits and shed load on suspicious traffic patterns.
# Configuration example: pin a fixed Reactor Core version via Maven
# Replace the version with the fixed release listed in the Spring advisory
mvn dependency:tree -Dincludes=io.projectreactor:reactor-core
mvn versions:use-dep-version \
-Dincludes=io.projectreactor:reactor-core \
-DdepVersion=<FIXED_VERSION> \
-DforceVersion=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
