CVE-2026-47857

Overview

Reactor Core is the non-blocking Reactive Streams foundation of Project Reactor for the JVM. It provides the Flux and Mono reactive types and the operators built on them, and libraries such as Reactor Netty and Spring WebFlux depend on it. The same repository publishes reactor-test, reactor-tools and reactor-core-micrometer, the Micrometer metrics and observation integration, which follows its own version line: reactor-core-micrometer 1.2.x ships alongside Reactor Core 3.7.x.

A denial of service vulnerability (CVE-2026-47857) has been identified in the Flux.windowTimeout operator of Reactor Core when fairBackpressure is enabled, which allows attackers to make a long-lived stream hang permanently without raising an error. An attacker who keeps connections open for a long time and controls how fast data is read can stop the stream from processing elements and exhaust resources.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Reactor Core.

Details

Module Info

• Product: Reactor Core
• Affected packages: io.projectreactor:reactor-core
• Affected versions: <=3.4.41, >=3.5.0 <=3.7.19, >=3.8.0 <=3.8.6
• GitHub repository: https://github.com/reactor/reactor-core
• Published packages: https://central.sonatype.com/artifact/io.projectreactor/reactor-core
• Package manager: Maven
• Fixed in:
  • OSS Reactor Core 3.8.7
  • NES for Project Reactor v3.7.22

Vulnerability Info

This Medium-severity vulnerability is found in the io.projectreactor:reactor-core package in multiple versions of Reactor Core. Calling Flux.windowTimeout(maxSize, maxTime, true) (or the overload that also takes a Scheduler) subscribes a FluxWindowTimeout.WindowTimeoutWithBackpressureSubscriber. That subscriber packs its state into a single long, and two of its fields are 20-bit counters: the index of the active window and the index of the next window. Both counters are masked when they are incremented, so after 1,048,576 windows they wrap from 1,048,575 back to 0.

When a window is due while downstream has no outstanding demand, the subscriber holds it back as unsent. Once downstream requests more, drain() delivers the held-back window and, if that window has already timed out or completed, decides whether to open the following window with an ordered comparison:

// we should create next window if we see that
// currentUnsentWindow is terminated and nextWindowIndex is
// greater than currentWindowIndex
if (nextWindowIndex > activeWindowIndex && (InnerWindow.isTimeout(previousInnerWindowState) || InnerWindow.isTerminated(previousInnerWindowState))) {
    final boolean shouldBeUnsent = n == 0;
    final InnerWindow<T> nextWindow =
            new InnerWindow<>(this.maxSize, this,
                    nextWindowIndex, shouldBeUnsent, logger);
    ...
}

Once the next-window index has wrapped to 0 while the active-window index is still 1,048,575, nextWindowIndex > activeWindowIndex is false even though a new window is due. The held-back window is delivered, but no next window is created, no new timeout is scheduled and no further elements are requested from upstream. The stream stops emitting windows but never signals an error or completion, so it hangs silently. A long-running pipeline that opens many windows, for example one window per timeout on a persistent connection, reaches the wrap-around point over time. A client that slows its reads so that downstream demand runs out around the wrap can then leave the stream, and the resources it holds, stuck indefinitely.

Mitigation

Only recent versions of Reactor Core are community-supported. Older release lines are End-of-Life and will not receive community updates addressing this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade Reactor Core to a currently supported release containing the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.