Read the docs
TI-2026-35306 Aliases CVE-2026-47857GHSA-p9xf-3946-vr35

Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

Priority LOW 27CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareReactor Core3.8.0 – 3.8.6; 3.5.0 – 3.7.19; up to 3.4.41—No fix listedCNA
  • Reactor Core VendorVMware Affected 3.8.0 – 3.8.6; 3.5.0 – 3.7.19; up to 3.4.41 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:*before 3.4.42; 3.5.0 to before 3.7.20; 3.8.0 to before 3.8.6.1VulnerableBroadcom
  • cpe:2.3:a:broadcom:reactor_core:*:*:*:*:*:*:*:* Versions before 3.4.42; 3.5.0 to before 3.7.20; 3.8.0 to before 3.8.6.1 Vulnerable ·Broadcom

Remediation

Red Hat 2 advisories

  • RHSA-2026:69440 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP2 release and security update
    • Red Hat build of Quarkus 3.33.3.SP2
  • RHSA-2026:69470 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP2 release and security update
    • Red Hat build of Quarkus 3.27.5.SP2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix planned: Out of support scope
Red Hat Data Grid 8AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet: Fix deferred
Red Hat build of Debezium 3AffectedNo fix yet: Fix deferred
Red Hat build of Quarkus 3.27.5.SP2Fixed RHSA-2026:69470
Red Hat build of Quarkus 3.33.3.SP2Fixed RHSA-2026:69440

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47857
  2. 2026-10-03 Alias added: GHSA-p9xf-3946-vr35
  3. 2026-10-09 Fix available: RHSA-2026:69440 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:69470 · Red Hat
  5. 2026-10-10 Fix available: Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2 · Red Hat

References

Advisory 1

  • TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8
See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences