In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.

A race condition exists between the flushing of buffered items and the arrival of new items from upstream. If new items arrive precisely during an active flush, the internal state can become corrupted, leaving items in the buffer indefinitely without scheduling a timeout. This causes the stream to permanently hang and stop processing elements. An attacker could exploit this by manipulating upstream delivery rates to trigger the race condition, potentially leading to resource exhaustion and a denial of service.