CVE-2026-47857

Executive Summary

CVE-2026-47857 is a Denial of Service (DoS) vulnerability in Reactor Core, a widely used reactive-streams library for the JVM. Applications employing the Flux.windowTimeout operator with the fairBackpressure option enabled are susceptible to a condition that can exhaust resources and cause service unavailability. The vulnerability affects Reactor Core versions 3.4.41 and earlier, 3.5.0 through 3.7.19, and 3.8.0 through 3.8.6. With a CVSS base score of 5.9 (Medium), the flaw can be triggered remotely, requires no authentication, and undermines availability with high impact.

Technical Analysis

The vulnerability resides in Reactor Core, the foundational library implementing Reactive Streams semantics for the Java ecosystem (Project Reactor). Reactor Core stands as the backbone of Spring WebFlux, Spring Cloud Gateway, and countless other reactive applications that leverage backpressure-aware, non-blocking event processing.

The affected operator, Flux.windowTimeout, is designed to partition an incoming stream into discrete time-bound windows. When a publisher emits elements faster than a consumer can process them, the operator uses windowing to group emissions, allowing downstream processing to operate on time-sliced batches.

The fairBackpressure option when enabled along with Flux.windowTimeout introduces a faulty fair-scheduling path in the operator's internal state machine. The NVD description indicates that enabling this combination creates a condition where the operator fails to properly manage its internal demand signals (i.e., the number of requested elements propagated upstream). This leads to unbounded buffer accumulation: the windowing mechanism requests more elements upstream than it can actually deliver downstream within a window boundary, causing memory pressure to grow without bound.

While the exact code path is not documented in the NVD description, the vulnerability class is clearly an Uncontrolled Resource Consumption (CWE-400) issue. The attack surface is entirely network-facing: any reactive application exposing an HTTP endpoint or message-consumer that uses Flux.windowTimeout (e.g., for rate-limiting, chunked processing, or time-windowed aggregation) can be driven to exhaust its heap. Because Reactor Core runs in the hot path of web servers and message brokers, memory exhaustion results in OutOfMemoryError exceptions, thread stalls, and proportional CPU escalation during garbage collection — effectively killing the service.

Notably, the flaw requires no authentication (PR:N) and no user interaction (UI:N), but does demand some level of attack complexity (AC:H). The high attack complexity likely stems from the need to either craft a specific stream pattern (e.g., a burst of data followed by a deliberate slow-down) or trigger window-boundary timing that aligns with the internal demand mismatch.

Due to the absence of a public patch or vendor advisory detailing code-level specifics, insufficient technical detail is available regarding the exact method invoked or the precise state-transition logic that fails. The analysis above is derived from the operator semantics and the vulnerability class.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain is inferred from the vulnerability class and operator semantics.

Step 1 — Reconnaissance/Identification: An attacker targets a public-facing reactive application. Fingerprinting identifies the framework stack — Spring Boot with WebFlux, or a Netty-based reactive gateway. Version inference is possible via HTTP response headers, actuator endpoints (/actuator/info, /actuator/health), error-page stack traces, or dependency disclosures in API metadata.

Step 2 — Flaw Trigger: The attacker identifies an endpoint that uses Flux.windowTimeout with fairBackpressure — common in rate-limited upload endpoints, streaming analytics pipelines, or time-based aggregation endpoints. The attacker then opens multiple concurrent connections or streams. The attack pattern requires alternating high-volume bursts with quiet periods to force the window boundary logic into the demand-mismatch state. This can be achieved by sending large payloads followed by TCP backpressure (delayed reads), causing the operator to request more upstream data than it can flush downstream within the window.

Step 3 — Payload/Execution: At the vulnerability-class level (uncontrolled resource consumption), the attack payload is a throttled data stream. The attacker exploits the inability of Flux.windowTimeout (with fairBackpressure) to correctly propagate demand signals, potentially achieving memory exhaustion through a carefully paced mix of rapid emission and consumer stalls.

Step 4 — Post-Exploitation Impact: The application heap grows until OutOfMemoryError occurs, aborting the JVM, or the GC thrashing saturates CPU and halts event processing. In a containerized deployment, the pod is OOM-killed and restarts; in a monolithic deployment, the application becomes unresponsive. Repeated attacks force a crash-reboot loop, making the service permanently unavailable (Availability: High impact per CVSS). There is no data exposure risk (CIA: C:N, I:N).

Impact Assessment

The vulnerability carries a CVSS v3.1 score of 5.9 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

• Attack Vector (AV:N): Remotely exploitable over the network.
• Attack Complexity (AC:H): Requires careful traffic shaping and timing; not trivially triggerable by a single malformed request.
• Privileges Required (PR:N): No authentication needed.
• User Interaction (UI:N): No user action required.
• Scope (S:U): Impact limited to the vulnerable component.
• Confidentiality/Integrity (C:N/I:N): No data loss or tampering.
• Availability (A:H): Complete denial of service.

Affected systems: Any JVM-based service using Reactor Core 3.4.41 and earlier, 3.5.0-3.7.19, or 3.8.0-3.8.6 that uses Flux.windowTimeout in conjunction with fairBackpressure=true. This includes enterprise microservices powered by Spring WebFlux, streaming integrations, event gateways, and reactive database access layers.

Business impact: Service downtime, SLO violations, crash-looping containers in orchestrated environments, and resultant reputational or financial damage. The attack complexity reduces immediate exposure risk in low-traffic applications but remains viable against high-throughput public APIs.

Blast radius: Confined to the specific application instance; adjacent systems are not directly affected but may suffer secondary effects (database connection pool exhaustion, message queue backlogs).

Detection Guidance

Sigma Rule

title: DoS Attempt - Reactor Core Flux.windowTimeout fairBackpressure Exploitation
id: 6f3d9c2e-4b1a-4e7f-8c2d-9a1b3c4d5e6f
status: experimental
description: Detects suspicious traffic patterns targeting reactive applications that may indicate exploitation of CVE-2026-47857, characterized by alternating high-volume bursts and TCP stalls targeting single endpoints.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47857
tags:
    - attack.t1499
    - attack.availability
logsource:
    category: webserver
    product: nginx
    definition: 'Web server access logs for applications using reactive Java frameworks'
detection:
    selection_high_rate:
        c-uri|startswith: '/'
        sc-status: 200
    selection_high_volume:
        sc-bytes|greater: 100000
    condition: selection_high_rate and selection_high_volume
    timeframe: 5m
    group_by: c-ip
    threshold: 250
falsepositives:
    - Legitimate large file uploads
    - Bulk data ingestion APIs
level: medium

YARA Rule

rule reactor_core_dos_indicator
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects reactor-core jar files containing affected version patterns for CVE-2026-47857"
        cve = "CVE-2026-47857"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $manifest = "Manifest-Version: 1.0"
        $impl_ver = "Implementation-Version" nocase
        $ver_3841 = "3.4.4" ascii
        $ver_375 = "3.7.5" ascii
        $ver_381 = "3.8.1" ascii
        $window_timeout = "windowTimeout" ascii
        $fair_backpressure = "fairBackpressure" ascii
    condition:
        uint32(0) == 0x04034B50 and
        ($ver_3841 or $ver_375 or $ver_381) and
        ($window_timeout and $fair_backpressure)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-47857 Potential Reactor Core DoS - Slow-drip Active Stream Against Reactive Endpoint"; flow:to_server,established; content:"POST"; http_method; content:"/"; http_uri; content:"chunked"; http_connection; threshold:type both, track by_src, count 100, seconds 60; reference:cve,2026-47857; classtype:attempted-dos; sid:202607857001; rev:1;)

Elastic Detection

// Elastic EQL - Detect repeated high-volume requests from single client
sequence by source.ip
  with maxspan=5m
  [network where
     destination.port == 80 or destination.port == 443]
  [network where
     destination.port == 80 or destination.port == 443]
  [network where
     destination.port == 80 or destination.port == 443]
  [network where
     bytes_out > 100000]

Splunk SPL Query

index=web sourcetype=access_combined
| stats count, sum(bytes) as total_bytes by clientip, uri
| where count > 200 AND total_bytes > 50000000
| eval threat_score = total_bytes / count
| where threat_score > 250000
| table _time, clientip, uri, count, total_bytes
| sort - total_bytes

Wazuh OSSEC Rule

<group name="reactor-core-dos,">
  <rule id="100257" level="10">
    <decoded_as>json</decoded_as>
    <field name="srcip">.</field>
    <field name="url" type="string">^/</field>
    <description>CVE-2026-47857: High-volume stream to reactive endpoint from single source - possible DoS attempt</description>
    <group>reactor,java,dos,</group>
    <if_sid>100200</if_sid>
    <match>windowTimeout|fairBackpressure</match>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch evidence from any tracked source was identified at this writing.

1) Immediate mitigations:

• Disable fairBackpressure: If Flux.windowTimeout is used, set fairBackpressure to false as a direct configuration change to avoid the vulnerable code path.
• Rate limiting: Implement per-IP request rate limits and payload size caps at the reverse proxy or gateway level (nginx limit_req, HAProxy stick-table rate limiting).
• Timeout hardening: Configure low read-idle timeouts on the network layer to break slow-drip client connections that could maintain the demand-mismatch state.
• Container limits: Enforce strict memory limits (--memory, Xmx) and set -XX:+ExitOnOutOfMemoryError to fail fast rather than thrash.

2) Patch/upgrade steps:

• Monitor the Project Reactor GitHub releases page (https://github.com/reactor/reactor-core/releases) and the Spring advisory feed for announced fixed versions.
• Assuming the patch follows semantic versioning convention, upgrade to Reactor Core 3.7.20+ for the 3.7.x line or 3.8.7+ for the 3.8.x line when released. For the 3.4.x line, upgrade to the latest 3.4.x patch release or migrate to a maintained line.
• After upgrading, run regression tests against Flux.windowTimeout usage with fairBackpressure=true under load to confirm the fix.

3) Long-term hardening:

• Conduct a full inventory of Flux.windowTimeout usage across all codebases and service meshes; audit any custom reactor extensions.
• Integrate dependency scanning (OWASP Dependency-Check, Snyk, Trivy) into CI/CD to auto-flag vulnerable Reactor Core versions.
• Adopt a canary-deployment strategy to validate new reactor-core versions under production-like streaming load before full rollout.
• For internet-exposed reactive services, enforce a Web Application Firewall (WAF) rule to rate-limit and cap connection durations.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47857
2. Project Reactor Official Site: https://projectreactor.io/
3. Reactor Core GitHub Releases: https://github.com/reactor/reactor-core/releases
4. CWE-400: Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
5. ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

Known campaigns/exploitation: No public exploit code, Nuclei template, or evidence of exploit-in-the-wild activity has been identified as of this report. This CVE is not listed on the CISA KEV catalog. Monitoring of hacker forums and dark-web marketplaces should continue for future weaponization.