The vulnerability lies in the Flux.bufferTimeout operator of Reactor Core when fairBackpressure is enabled. During an active flush, if upstream delivers items, the pipeline can permanently hang. The result is a denial of service, causing affected applications to become unresponsive and potentially exhausting system resources. This flaw corresponds to uncontrolled resource consumption (CWE-400).

Spring Reactor Core is affected. Versions 3.8.0 through 3.8.6 and all releases 3.7.19 and earlier are vulnerable. Any deployment using these components with the bufferTimeout operator and fairBackpressure enabled is at risk.

The CVSS score of 5.9 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in the KEV catalog. Attackers would need to send items to an upstream publisher during a pipeline flush—an activity typically limited to trusted components but potentially exploitable by a compromised or malicious service. Once triggered, the freeze is permanent until the application is restarted, resulting in a persistent denial of service.