Reactor Core
Monthly
Flux.bufferTimeout operator in Spring Reactor Core can be driven into a Denial of Service condition when the fairBackpressure option is explicitly enabled, affecting versions 3.8.0-3.8.6 and 3.7.19 and earlier. Remote unauthenticated attackers who can reach the application's reactive endpoints may exploit the pathological backpressure state to fully disrupt availability. No public exploit has been identified at time of analysis, and the non-default configuration requirement materially narrows the real-world attack surface.
Denial of Service in Spring Reactor Core affects any JVM service that uses the Flux.windowTimeout operator with the fairBackpressure option enabled, across three major release trains (3.4.x through 3.8.6). An unauthenticated network attacker can trigger resource exhaustion or stall the reactive pipeline, causing full availability loss for the affected service. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; the high attack complexity rating (AC:H) reflects the requirement for a specific, non-default operator configuration.
Flux.bufferTimeout operator in Spring Reactor Core can be driven into a Denial of Service condition when the fairBackpressure option is explicitly enabled, affecting versions 3.8.0-3.8.6 and 3.7.19 and earlier. Remote unauthenticated attackers who can reach the application's reactive endpoints may exploit the pathological backpressure state to fully disrupt availability. No public exploit has been identified at time of analysis, and the non-default configuration requirement materially narrows the real-world attack surface.
Denial of Service in Spring Reactor Core affects any JVM service that uses the Flux.windowTimeout operator with the fairBackpressure option enabled, across three major release trains (3.4.x through 3.8.6). An unauthenticated network attacker can trigger resource exhaustion or stall the reactive pipeline, causing full availability loss for the affected service. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; the high attack complexity rating (AC:H) reflects the requirement for a specific, non-default operator configuration.