cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. If a stream remains active for an extended period and experiences specific downstream backpressure conditions, an internal state tracking flaw can be triggered. This causes the stream to permanently hang and stop processing elements without raising an error. An attacker could exploit this by maintaining long-lived connections and manipulating read speeds, potentially leading to resource exhaustion and a denial of service.

Spring Security Advisoriesで読む