CVE-2026-47863

Executive Summary

CVE-2026-47863 is a Denial of Service (DoS) vulnerability affecting the Reactor Core reactive programming library from Broadcom/VMware. Applications utilizing the Flux.bufferTimeout operator with fairBackpressure enabled are susceptible to resource exhaustion, allowing a remote unauthenticated attacker to degrade or completely halt service availability. The vulnerability affects Reactor Core versions 3.8.0 through 3.8.6, and all versions 3.7.19 and earlier. With a CVSS base score of 5.9 (High availability impact), the flaw is exploitable over the network without authentication, though it requires high attack complexity. The Common Weakness Enumeration identifies this as CWE-835, indicating a loop with unreachable exit condition. Currently, no public proof-of-concept exploits are known, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability resides in the Flux.bufferTimeout operator, a core component of Reactor Core's reactive stream processing pipeline. This operator is designed to accumulate elements emitted by a source Flux into buffered collections, releasing them either when a maximum buffer size is reached or when a specified timeout window expires. The fairBackpressure parameter, when enabled, alters the operator's internal scheduling and request-tracking behavior to distribute backpressure signals more evenly across multiple subscribers.

The flaw, classified as CWE-835 (Loop with Unreachable Exit Condition), suggests that under specific conditions involving fairBackpressure, the operator's internal state machine can enter a loop where the exit condition is never satisfied. In reactive programming, backpressure coordination relies on a request-accounting mechanism: each subscriber signals how many elements it can handle via request(n), and the publisher tracks these outstanding demands. When fairBackpressure is enabled, the bufferTimeout operator must track outstanding demand across multiple downstream consumers and manage timer-based buffer release concurrently.

The vulnerability mechanism likely involves a race condition or state inconsistency between the buffer drain logic and the backpressure demand accounting. When the operator processes signals from upstream sources and downstream subscribers, a specific interleaving of events can cause the operator to repeatedly attempt buffer emission without ever satisfying the condition required to complete the operation. This could manifest as an infinite loop consuming CPU cycles, or as unbounded memory growth as buffers accumulate without being released downstream. The high attack complexity (AC:H) indicates that an attacker must arrange a specific sequence of events or data patterns to trigger the faulty state, distinguishing this from simpler resource exhaustion flaws.

From a technical standpoint, the affected component processes asynchronous signals through Reactor's event loop scheduler. The bufferTimeout operator with fairBackpressure likely implements a shared state variable tracking pending requests per subscriber. When buffer element counts reach thresholds simultaneously with timeout expiration signals, the operator may miscompute the remaining demand, causing it to re-queue buffer release attempts that never match the expected condition. The CWE-835 classification points to a control flow issue where the loop's terminating predicate is unreachable due to corrupted state or an off-by-one error in demand accounting.

The attack surface comprises all reactive applications built on Reactor Core that: (1) use the bufferTimeout operator, (2) enable the fairBackpressure flag, and (3) accept input from untrusted network sources. This includes REST APIs implementing streaming responses, event-processing pipelines, messaging consumers, and microservices using WebFlux for reactive HTTP handling.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and NVD description. The high attack complexity suggests the attacker needs to carefully craft triggering conditions.

Step 1 — Reconnaissance and Target Identification: An attacker first identifies reactive applications built on Reactor Core. This can be accomplished through response header analysis (e.g., Server: ReactorNetty or Spring Boot banner strings), error messages revealing reactive stack traces, or behavioral fingerprinting — observing streaming/backpressure behavior patterns in HTTP chunked responses. Version identification may be possible through dependency disclosure in error pages or API documentation.

Step 2 — Flaw Class Triggering: The attacker crafts a request pattern designed to trigger the faulty state in the bufferTimeout operator. Since the vulnerability involves demand miscomputation under fairBackpressure, the attacker must generate a data stream that creates contention between buffer-timeout expiration and backpressure signals. This could involve sending data bursts followed by deliberate pauses, or using slow-consuming downstream connections to force backpressure while the upstream continues emitting.

Step 3 — Payload/Execution Method: At the vulnerability-class level, the attacker sends a sequence of HTTP requests or establishes multiple concurrent streaming connections. Each connection submits data that causes the target application's bufferTimeout operator to accumulate elements. By varying request rates and payload sizes, the attacker induces the unreachable-exit-condition loop. The "payload" is not malicious data content but rather a traffic pattern — timing and volume — that forces the reactor's state machine into the broken state. High attack complexity means this likely requires repeated attempts with increasingly precise timing to hit the race condition window.

Step 4 — Post-Exploitation Impact: Once the vulnerable state is triggered, the affected worker threads enter an infinite loop or accumulate memory without bound. Available throughput drops to zero as the reactive event loop becomes saturated, causing all requests on the affected instance to experience extreme latency or time out. In single-instance deployments, this results in complete unavailability. In clustered deployments, the load balancer may remove the affected node from rotation, shifting traffic to remaining nodes — potentially cascading if multiple nodes are triggered. The impact is entirely on availability (C:N/I:N/A:H); there is no data confidentiality or integrity compromise. Recovery requires process restart, as the corrupted operator state persists.

Impact Assessment

CVSS Analysis: The vulnerability has a base score of 5.9 (Medium severity). The vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H indicates: network-exploitable, requires no privileges, needs no user interaction, but demands significant attacker skill or favorable conditions (high complexity). The high availability impact reflects total loss of service availability to legitimate users.

Business Impact: For organizations running reactive microservices or API gateways on Reactor Core, exploitation results in service outages. Recovery requires manual restart, and the attack can be repeated at will, enabling sustained DoS campaigns. The business impact is amplified for time-sensitive services — payment processing, real-time analytics, trading platforms — where downtime translates directly to revenue loss and regulatory exposure.

Blast Radius: Confirmed affected versions span Reactor Core 3.7.19 and earlier, plus 3.8.0 through 3.8.6. This covers a substantial portion of the Spring Boot 3.x ecosystem, as Reactor Core is the underlying reactive engine for Spring WebFlux, Spring Cloud Gateway, and Project Reactor-based data pipelines. Applications using bufferTimeout with fairBackpressure are explicitly at risk; organizations using the operator without the flag or using different buffering operators (e.g., buffer, window) are not directly exposed.

EPSS Context: An EPSS score of 0.00222 (12.7th percentile) indicates low exploitation probability in the near term. No CISA KEV listing, no public exploits, and no Nuclei templates exist. This suggests the vulnerability is unlikely to be mass-exploited but remains a targeted-attack vector for adversaries focusing on specific high-value reactive infrastructure.

Detection Guidance

Detection focuses on identifying anomalous behavior consistent with resource-exhaustion attacks against reactive streaming applications, and on identifying versions of Reactor Core that are vulnerable.

Sigma Rule

title: Reactor Core bufferTimeout fairBackpressure DoS - Anomalous Request Pattern
id: 7a4f3c9e-2b85-4f61-a3d1-8e9c7b2d5a01
status: experimental
description: Detects anomalous request patterns targeting applications using Reactor Core bufferTimeout with fairBackpressure
author: valtersit.com Threat Intelligence
date: 2026/07/15
logsource:
  category: webserver
  product: nginx
  definition: 'Detection of requests to reactive endpoints'
detection:
  selection:
    c-uri|contains:
      - '/stream'
      - '/events'
      - '/reactive'
  condition:
    - high_rate_same_ip
  timeframe: 60s
  high_rate_same_ip:
    client_ip:
      - client: ip_address
    aggregation:
      count: '>= 500'
      distinct: c-uri
      max: 1
filter:
  client_ip:
    - 127.0.0.1
    - '10.0.0.0/8'
    - '172.16.0.0/12'
    - '192.168.0.0/16'
level: medium
tags:
  - attack.t1498
  - attack.t1499
  - cve.2026.47863

YARA Rule

rule ReactorCore_CVE2026_47863_Vulnerable_Strings {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects known vulnerable Reactor Core versions via string artifacts"
        cve = "CVE-2026-47863"
        date = "2026-07-15"
        severity = "medium"
    strings:
        $a = "reactor-core-3.8.6" ascii nocase
        $b = "reactor-core-3.8.5" ascii nocase
        $c = "reactor-core-3.8.4" ascii nocase
        $d = "reactor-core-3.8.3" ascii nocase
        $e = "reactor-core-3.8.2" ascii nocase
        $f = "reactor-core-3.8.1" ascii nocase
        $g = "reactor-core-3.8.0" ascii nocase
        $h = "reactor-core-3.7.19" ascii nocase
    condition:
        any of them
}

rule ReactorCore_CVE2026_47863_ProxyClass_Artifacts {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects Spring Boot fat jars containing reactive streaming components"
        cve = "CVE-2026-47863"
    strings:
        $x = "reactor/core/publisher/FluxBufferTimeout.class" ascii
        $y = "reactor/core/publisher/FluxBufferTimeout" ascii
        $z = "META-INF/maven/io.projectreactor/reactor-core" ascii
    condition:
        any of them
}

Suricata IDS Rule

alert ip any any -> $HOME_NET any (msg:"ET DOS Reactor Core bufferTimeout fairBackpressure CVE-2026-47863 - Excessive Connection Attempts"; flow:to_server; threshold:type both, track by_src, count 500, seconds 60; classtype:attempted-dos; sid:500047863; rev:1; metadata:created_at 2026_07_15, updated_at 2026_07_15, cve CVE-2026-47863;)

alert http any any -> $HOME_NET any (msg:"ET DOS Reactor Core bufferTimeout fairBackpressure - Stalled Stream Consumption Pattern"; flow:to_server,established; content:"GET"; http_method; content:"/stream"; http_uri; content:"!|20|"; threshold:type threshold, track by_src, count 100, seconds 60; classtype:attempted-dos; sid:500047864; rev:1; metadata:created_at 2026_07_15, updated_at 2026_07_15, cve CVE-2026-47863;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=1m
  [network where event.type == "connection" and event.action == "connected" and destination.port == 443] with runs=5
  [network where event.type == "connection" and event.action == "disconnected" and destination.port == 443 and network.bytes_sent < 1000] with runs=5

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and destination.port == 80] with runs=20
  [network where event.category == "network" and destination.port == 80 and process.name == "java"] with runs=200
  [process where event.action == "end" and process.name == "java" and process.exit_code == 137]

Splunk SPL Query

index=* sourcetype=access_combined status=200 uri=*stream*
| bin _time span=1m
| stats count as req_count by clientip, _time
| where req_count > 100
| eventstats avg(req_count) as avg_req, stdev(req_count) as std_req
| where req_count > (avg_req + 3*std_req)
| table _time clientip req_count
| sort -req_count

index=* sourcetype=java_springboot "bufferTimeout" OR "FluxBufferTimeout" OR "fairBackpressure"
| rex field=_raw "outOfMemory|GC overhead|Deadlock|Infinite loop|Thread pool exhausted|RejectedExecutionException"
| stats count by host, source, _time
| where count > 0
| table _time host source count

Wazuh OSSEC Rule

<group name="reactor_core,">
  <rule id="100478" level="10" frequency="20" timeframe="60">
    <if_matched_sid>31100</if_matched_sid>
    <description>Possible Reactor Core bufferTimeout fairBackpressure DoS - Repeated requests to reactive endpoint</description>
    <field name="url">\.stream|events|reactive</field>
    <match>GET|POST|PUT</match>
    <same_source_ip />
    <options>no_full_log</options>
    <group>dos,reactive_core,</group>
  </rule>

  <rule id="100479" level="12">
    <if_sid>100478</if_sid>
    <description>CVE-2026-47863 exploitation attempt - sustained high-volume traffic to reactive endpoints</description>
    <match>GET|POST|PUT</match>
    <group>dos,reactive_core,cve_2026_47863,</group>
  </rule>

  <rule id="100480" level="9">
    <if_matched_sid>100479</if_matched_sid>
    <description>Reactor Core DoS confirmed - correlate with application crash or resource exhaustion</description>
    <match>outofmemory|gc overhead|rejectedexecutionexception|thread pool</match>
    <group>dos,reactive_core,cve_2026_47863,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A single source (NVD) claims a patch exists, but it has not been independently confirmed. The vendor fix is not yet publicly documented.

1. Immediate Mitigations:

   • Audit all production applications for usage of Flux.bufferTimeout with fairBackpressure enabled. If found, disable fairBackpressure (set to false) as an interim measure, as the vulnerability specifically targets this configuration.
   • If fairBackpressure cannot be disabled due to functional requirements, implement rate limiting and request throttling at the edge (reverse proxy, API gateway) to reduce the probability of an attacker generating the complex triggering conditions.
   • Configure connection limits per client IP and cap concurrent streaming connections to prevent resource-exhaustion amplification.
   • Monitor application CPU usage and memory metrics for anomalous spikes, and configure auto-restart policies for affected services.

2. Patch/Upgrade Steps:

   • Subscribe to the Broadcom/VMware security advisory feed and the Project Reactor release notes for version 3.8.7 (or later) and 3.7.20 (or later), which may contain the fix.
   • Upon availability of a patched version, upgrade Reactor Core in a staging environment and run full integration tests focused on bufferTimeout and fairBackpressure behavior before production rollout.
   • Validate that no other dependencies (e.g., Spring Boot, Spring Cloud) pin Reactor Core to a vulnerable version; force a version override via Maven/Gradle dependency management if necessary.
   • Verify the patch integrity against checksums published by the vendor.

3. Long-Term Hardening:

   • Establish a dependency vulnerability scanning pipeline (e.g., OWASP Dependency-Check, Snyk, Trivy) covering JVM libraries.
   • Implement network-level anomaly detection to identify DoS attack patterns targeting reactive endpoints.
   • Design reactive applications with resilience patterns: bulkheads, circuit breakers, and dedicated thread pools for reactive streaming to isolate failure domains.
   • Maintain an internal registry of trusted dependency versions with security review requirements before adoption.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47863
2. Broadcom/VMware Security Portal: https://www.broadcom.com/support/security-center (check for advisory matching CVE-2026-47863)
3. Project Reactor Official Site: https://projectreactor.io/ (reference release notes for version comparison and patch status)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-47863 is NOT listed as of this report — verification recommended)
5. CWE-835 Reference: https://cwe.mitre.org/data/definitions/835.html (Loop with Unreachable Exit Condition)

Threat Actor Campaigns: As of this report, there is no evidence of active exploitation, exploit-in-the-wild activity, or known threat actor campaigns leveraging CVE-2026-47863. The EPSS score of 0.00222 (12.7th percentile) supports a low immediate exploitation likelihood. However, given the reach of Reactor Core within the Spring ecosystem, organizations should monitor for targeted attacks by adversaries who perform their own vulnerability research. The lack of public exploit code does not guarantee safety — sophisticated threat actors maintain private exploit development pipelines.