Reactor Core
Monthly
Denial of service in Spring Reactor Core exposes reactive Java applications to an infinite-loop condition (CWE-835) when the Flux.bufferTimeout operator is used with fairBackpressure enabled. Affected branches span 3.7.x through 3.7.19 and 3.8.0 through 3.8.6, meaning applications on both supported and legacy release trains are vulnerable. No active exploitation has been identified (SSVC: none), and EPSS probability sits at 0.22%, but the network-accessible nature of reactive endpoints makes this a realistic denial-of-service vector for exposed services using the specific configuration.
Denial of Service in Spring Reactor Core affects any JVM service that uses the Flux.windowTimeout operator with the fairBackpressure option enabled, across three major release trains (3.4.x through 3.8.6). An unauthenticated network attacker can trigger resource exhaustion or stall the reactive pipeline, causing full availability loss for the affected service. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; the high attack complexity rating (AC:H) reflects the requirement for a specific, non-default operator configuration.
Denial of service in Spring Reactor Core exposes reactive Java applications to an infinite-loop condition (CWE-835) when the Flux.bufferTimeout operator is used with fairBackpressure enabled. Affected branches span 3.7.x through 3.7.19 and 3.8.0 through 3.8.6, meaning applications on both supported and legacy release trains are vulnerable. No active exploitation has been identified (SSVC: none), and EPSS probability sits at 0.22%, but the network-accessible nature of reactive endpoints makes this a realistic denial-of-service vector for exposed services using the specific configuration.
Denial of Service in Spring Reactor Core affects any JVM service that uses the Flux.windowTimeout operator with the fairBackpressure option enabled, across three major release trains (3.4.x through 3.8.6). An unauthenticated network attacker can trigger resource exhaustion or stall the reactive pipeline, causing full availability loss for the affected service. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; the high attack complexity rating (AC:H) reflects the requirement for a specific, non-default operator configuration.