The vulnerability lies in the Flux.bufferTimeout operator of Reactor Core when fairBackpressure is enabled. During an active flush, if upstream delivers items, the pipeline can permanently hang. The result is a denial of service, causing affected applications to become unresponsive and potentially exhausting system resources. This flaw corresponds to unlimited loops caused by improper resource handling (CWE-835) and possible memory exhaustion due to exceeding maximum storage capacity (CWE-770).

Spring Reactor Core is affected. Versions 3.8.0 through 3.8.6 and all releases 3.7.19 and earlier are vulnerable. Any deployment using these components with the bufferTimeout operator and fairBackpressure enabled is at risk.

The CVSS score of 5.9 indicates a moderate severity. Based on the description, the likely attack vector involves an upstream publisher delivering items during a bufferTimeout flush. The EPSS score is < 1% and the vulnerability is not listed in the KEV catalog. Attackers would need to send items to an upstream publisher during a pipeline flush—an activity typically limited to trusted components but potentially exploitable by a compromised or malicious service. Once triggered, the freeze is permanent until the application is restarted, resulting in a persistent denial of service.