CVE-2026-47863 is a medium severity (CVSS 5.9) denial of service in Reactor Core. Applications that use Flux.bufferTimeout with fairBackpressure enabled can be affected. The open source fix is Reactor Core 3.8.7. The steps below show how to check your version and what to change.
What's affected
- Reactor Core 3.8.0 to 3.8.6. Fixed in 3.8.7 (open source).
- Reactor Core 3.8.6.1 and 3.7.20 are available to Enterprise Support customers.
Affected ranges differ between sources. The record says Reactor Core 3.8.0 to 3.8.6 and 3.7.19 and earlier. Spring's advisory says 3.8.0 to 3.8.6 and 3.5.7 through 3.7.19, and lists no separate fix for the 3.5.x line. Use the advisory's lower bound of 3.5.7 when you plan, because it is the more specific statement.
The advisory rates it Medium with an availability-only impact (CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). It states no other mitigation steps are needed besides upgrading.
How to check if you're exposed
For Maven projects, print the resolved version:
mvn dependency:tree | grep reactor-core
For Gradle projects:
./gradlew dependencies | grep reactor-core
Check the transitive tree, not only your direct dependencies, because Spring components often arrive through a starter or a parent BOM.
Then search your own code for the operator named in the advisory:
grep -rn "bufferTimeout" src/
Only applications that call it with fair backpressure enabled are described as vulnerable. Libraries you depend on can also call it, so a clean search of your own code is not proof.
What to do now
- Upgrade Reactor Core to 3.8.7 or later where you can.
- If you are on 3.7.x or 3.5.x, check with your vendor or subscription for the fixed build, or move to the 3.8 line.
- Find calls to
bufferTimeoutwith fair backpressure and note which services use them. - Add liveness and CPU alerts so a stuck pipeline is noticed, since the effect is a hang or resource burn.
Why it matters
The record lists CWE-835, a loop with an unreachable exit condition. In this case a reactive operator that should make progress can get stuck, consuming resources and stopping the pipeline.
Denial of service bugs in streaming code are easy to underrate. The base score is only 5.9 and the attack complexity is high, but a stuck message pipeline can stall a whole service. The record does not mark this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to use bufferTimeout directly to be affected?
The advisory describes applications using it with fair backpressure. A library you depend on could also use it, so check the dependency as well as your own code.
Which sources do I trust for the range?
Use Spring's advisory. It lists 3.5.7 through 3.7.19 for older lines, which is more specific than the record.
Sources
Last reviewed: 18 October 2026.
