Spring Reactor Core CVE-2026-47863

Exploitation requires that the target application explicitly uses the Flux.bufferTimeout operator with the fairBackpressure parameter set to true - this is an opt-in, non-default configuration that must be deliberately coded by the application developer. The attacker must be able to reach an HTTP or network endpoint whose reactive pipeline includes this operator chain; no authentication is required from the attacker's perspective if the endpoint is public. Limiting factors: the vast majority of Reactor Core deployments do not use fairBackpressure mode, so this condition significantly constrains the real exposed population; SSVC Automatable: no confirms the attack cannot be trivially mass-scanned and exploited without prior knowledge of the target's reactive topology.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as a high-severity, unauthenticated, network-exploitable DoS, but several signals collectively argue for a lower practical priority. SSVC classifies the attack as non-automatable and technical impact as partial, which conflicts with the AC:L/PR:N vector - the discrepancy is explained by the fairBackpressure deployment condition: an attacker cannot exploit this against any arbitrary Reactor Core deployment; only applications that explicitly opt into fairBackpressure on Flux.bufferTimeout are vulnerable. EPSS at 0.22% (13th percentile) reflects no observed exploitation activity. There is no CISA KEV entry and no public exploit code identified at time of analysis. Real-world priority should be considered moderate: high for teams operating reactive gateways or high-throughput pipelines with fairBackpressure enabled, but effectively nil for the majority of Reactor Core consumers who do not use this specific operator configuration.

An attacker identifies a publicly accessible Spring WebFlux endpoint backed by a Flux.bufferTimeout pipeline with fairBackpressure enabled and sends a crafted or high-rate stream of requests that drives the operator into the infinite-loop condition. The affected Reactor scheduler thread stalls permanently, starving all reactive pipelines sharing that scheduler and rendering the service unresponsive. No public exploit code has been identified at time of analysis, but the straightforward network-accessible trigger lowers the bar for discovery by motivated actors.