Reactor Core contains a flaw that allows applications using the Flux.windowTimeout operator with fairBackpressure enabled to suffer a denial of service. The operator internally manages a 20‑bit index that can wrap around, causing the stream to hang when the wrap occurs. As the stream stalls, the application is rendered unresponsive, compromising availability.

The vulnerability affects Spring Reactor Core version 3.8.0 through 3.8.6, 3.5.0 through 3.7.19, and 3.4.41 and all earlier releases. Any project that depends on these Reactor Core releases and runs the windowTimeout operator with fairBackpressure enabled is potentially impacted.

With a CVSS score of 5.9 the flaw is considered a moderate severity issue. The EPSS score indicates less than 1%, suggesting a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the affected application be configured to use windowTimeout with fairBackpressure; therefore, the attack vector appears to be internal, confined to the application’s runtime environment, and not remotely accessible.