Executive brief
Project Reactor Core is a reactive programming library used in Java applications for asynchronous data stream processing. When applications use the Flux.windowTimeout operator with fair backpressure enabled, an attacker can trigger a denial of service condition that disrupts the application's ability to process data streams and respond to requests.
Technical details
This vulnerability exists in the Flux.windowTimeout operator implementation in Project Reactor Core when fairBackpressure is enabled. The vulnerability allows remote attackers to trigger a denial of service condition by crafting requests that exploit improper handling of windowed timeouts and backpressure mechanisms. The attack is network-reachable for applications exposing reactive endpoints. An attacker can cause excessive resource consumption or processing delays that degrade or prevent normal application operation. Patches are available in Reactor Core 3.8.7, 3.7.20, and 3.4.42 or later.
Affected products
- Project Reactor Reactor Core 3.8.0-3.8.6, 3.5.0-3.7.19, 3.4.41 and earlier
Timeline
- 2026-08-27: disclosed