{"id":"spring-security-2e37f59a8de6","seq":2071,"kind":"advisory","title":"cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush","url":"https://spring.io/security/cve-2026-47863","permalink":"https://vulnpulse.app/items/spring-security-2e37f59a8de6","summary":"In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. A race condition exists between the flushing of buffered items and the arrival of new items from upstream. If new items arrive precisely during an active flush, the internal state can become corrupted, leaving items in the buffer indefinitely without scheduling a timeout. This causes the stream to permanently hang and stop processing elements. An attacker could exploit this by manipulating upstream delivery rates to trigger the race condit…","severity":null,"techs":["spring","java"],"cves":["CVE-2026-47863"],"tags":["security"],"source":{"id":"spring-security","name":"Spring Security Advisories"},"published_at":"2026-08-20T00:00:00.000Z","fetched_at":"2026-10-21T16:17:45.704Z"}