Denial of Service in Reactor Core via Flux.bufferTimeout

Executive Summary

This vulnerability is a Denial of Service (DoS) condition in Reactor Core's Flux.bufferTimeout operator when fairBackpressure is enabled. A race condition occurs if new items arrive during an active flush, corrupting internal state and causing the pipeline to hang indefinitely, stopping all processing.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking Reactor Core versions and monitoring for pipeline hangs. Use commands like 'find . -name "*.jar" -exec grep -l "reactor-core" {} \;' to locate Reactor Core dependencies. Check version numbers in dependency files or logs. Monitor application logs for stalled processing or indefinite hangs in Flux.bufferTimeout operations.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to trigger resource exhaustion by manipulating upstream delivery rates, causing the application to stop processing elements. This can lead to system downtime, degraded performance, or complete service unavailability for users relying on the affected Reactor Core versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing service disruptions due to a Denial of Service condition. If exploited, it may lead to prolonged downtime, affecting data processing or availability, which could violate availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Reactor Core to version 3.8.7 (OSS) or 3.7.20 (Enterprise Support Only). Disable fairBackpressure in Flux.bufferTimeout if upgrading is not immediately possible. Monitor systems for signs of DoS and restrict upstream delivery rates to reduce attack surface.

Useful 0 Not Useful 0