CVE-2026-47857

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47857", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-05-20T10:00:55.156Z", "datePublished": "2026-08-26T23:28:44.743Z", "dateUpdated": "2026-08-27T15:07:38.775Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-26T23:28:44.743Z"}, "title": "Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-190 Integer Overflow or Wraparound", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition."}]}], "affected": [{"vendor": "Spring", "product": "Reactor Core", "versions": [{"status": "affected", "version": "3.8.0", "lessThanOrEqual": "3.8.6", "versionType": "custom"}, {"status": "affected", "version": "3.5.0", "lessThanOrEqual": "3.7.19", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThanOrEqual": "3.4.41", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.</p><p>Reactor Core 3.8.0 - 3.8.6<br/>Reactor Core 3.5.0 - 3.7.19<br/>Reactor Core 3.4.41 and earlier</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-47857"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-27T15:07:04.132397Z", "id": "CVE-2026-47857", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T15:07:38.775Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47857", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T15:07:04.132397Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T15:07:08.808Z"}}], "cna": {"title": "Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Reactor Core", "versions": [{"status": "affected", "version": "3.8.0", "versionType": "custom", "lessThanOrEqual": "3.8.6"}, {"status": "affected", "version": "3.5.0", "versionType": "custom", "lessThanOrEqual": "3.7.19"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.4.41"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-47857"}], "descriptions": [{"lang": "en", "value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier", "supportingMedia": [{"type": "text/html", "value": "<p>In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.</p><p>Reactor Core 3.8.0 - 3.8.6<br/>Reactor Core 3.5.0 - 3.7.19<br/>Reactor Core 3.4.41 and earlier</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-26T23:28:44.743Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47857", "state": "PUBLISHED", "dateUpdated": "2026-08-27T15:07:38.775Z", "dateReserved": "2026-05-20T10:00:55.156Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-08-26T23:28:44.743Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Reactor Core", "vendor": "Spring", "versions": [{"lessThanOrEqual": "3.8.6", "status": "affected", "version": "3.8.0", "versionType": "custom"}, {"lessThanOrEqual": "3.7.19", "status": "affected", "version": "3.5.0", "versionType": "custom"}, {"lessThanOrEqual": "3.4.41", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:*", "matchCriteriaId": "EBE26585-E37D-4085-984D-1942173D884A", "versionEndExcluding": "3.4.42", "vulnerable": true}, {"criteria": "cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE4C3457-2E8E-49CD-B672-CE2BD5215BB7", "versionEndExcluding": "3.7.20", "versionStartIncluding": "3.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:*", "matchCriteriaId": "90E8F304-6A43-40C5-A0D9-25A397D84B72", "versionEndExcluding": "3.8.6.1", "versionStartIncluding": "3.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier"}], "id": "CVE-2026-47857", "lastModified": "2026-09-04T20:10:22.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47857", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-27T15:07:04.132397Z", "version": "2.0.3"}}]}, "published": "2026-08-27T01:17:32.687", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2026-47857"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "io.projectreactor/reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure", "id": "2524774", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524774"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier", "A flaw was found in Reactor Core. A remote attacker could exploit this vulnerability by using the Flux.windowTimeout operator with fairBackpressure enabled, leading to a Denial of Service (DoS) condition. This could cause applications to become unresponsive or crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-47857", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Out of support scope", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Fix deferred", "package_name": "reactor-core", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "reactor-core", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "reactor-core", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "reactor-core", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "reactor-core", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-08-26T23:28:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-47857\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47857\nhttps://spring.io/security/cve-2026-47857"], "statement": "This Moderate flaw in Reactor Core can result in a denial of service for applications configured to use the Flux.windowTimeout operator with fairBackpressure enabled. The impact is confined to service availability and requires the specific operator and backpressure setting to be actively deployed within the application.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.8.0,3.8.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.7.19]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.4.41]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "reactor_core", "vendor": "spring"}], "created": "2026-08-27T01:30:13.936091+00:00", "updated": "2026-09-04T02:00:05.668480+00:00", "vendors": ["spring", "spring$PRODUCT$reactor_core"]}