Executive brief
Project Reactor Core is a popular reactive programming library used in Java applications to handle asynchronous data streams. Applications using the Flux.bufferTimeout operator with fair backpressure enabled can be forced into a denial of service condition, making the affected service unresponsive to legitimate user requests.
Technical details
This vulnerability affects the Flux.bufferTimeout operator in Reactor Core when fairBackpressure is enabled. The vulnerability is a denial of service condition that can be triggered through network-based attack vectors. An attacker can send carefully crafted requests to exhaust resources or trigger unhandled conditions in the buffering logic, causing the application to become unresponsive. The issue affects Reactor Core versions 3.8.0 through 3.8.6 and version 3.7.19 and earlier. Patches are expected to be available in patched releases.
Affected products
- VMware Reactor Core 3.7.19 and earlier, 3.8.0 through 3.8.6
Timeline
- 2026-08-27: disclosed
- 2026-08-27: advisory