Search: CVE-2026-47857

CVE-2026-47857 is an integer overflow vulnerability in Spring Reactor Core affecting applications using the Flux.windowTimeout operator with fairBackpressure enabled. This flaw can lead to a Denial of Service (DoS) condition. The vulnerability impacts multiple versions of Reactor Core, including 3.8.0 through 3.8.6, 3.5.0 through 3.7.19, and 3.4.41 and earlier. The CVSS score is 5.9, indicating a medium severity level. No official patch or remediation guidance is currently available.