CVE-2026-47863: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') in Spring Reactor Core

This vulnerability in Reactor Core arises from a loop with an unreachable exit condition (CWE-835) when the Flux.bufferTimeout operator is used with fairBackpressure enabled. The affected versions include Reactor Core 3.7.19 and earlier up to 3.8.6. The infinite loop can cause a denial of service by exhausting resources. The CVSS v3.1 base score is 5.9, reflecting a network attack vector with high attack complexity and no impact on confidentiality or integrity but high impact on availability. No known exploits are reported in the wild, and no official remediation or patch is currently documented.

Successful exploitation causes a denial of service condition due to an infinite loop in the affected Reactor Core versions. This impacts application availability but does not affect confidentiality or integrity. The attack requires network access and has high complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the Flux.bufferTimeout operator with fairBackpressure enabled in affected versions or implement application-level safeguards to detect and mitigate potential infinite loops.