## cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

- 種別: advisory
- 関連技術: spring, java
- CVE: CVE-2026-47863
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-47863)
- パーマリンク: https://vulnpulse.app/items/spring-security-2e37f59a8de6

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. A race condition exists between the flushing of buffered items and the arrival of new items from upstream. If new items arrive precisely during an active flush, the internal state can become corrupted, leaving items in the buffer indefinitely without scheduling a timeout. This causes the stream to permanently hang and stop processing elements. An attacker could exploit this by manipulating upstream delivery rates to trigger the race condit…