WebSocket Client Credentials Leak in Reactor Netty
CVE-2026-47848

6.1MEDIUM

Key Information:

Vendor

Spring

Status
Reactor Netty
Vendor
CVE Published:
26 August 2026

What is CVE-2026-47848?

An issue exists where the Reactor Netty WebSocket client can inadvertently leak credentials during WebSocket handshake processes. This vulnerability occurs specifically when the HTTP client is configured to follow redirects, leading to the possibility of sensitive information being sent to an unintended origin during the redirect process. Affected versions include several releases from 1.0.52 up to 1.3.6. Users are advised to review their configurations and upgrade to secure versions to mitigate this risk.

Affected Version(s)

Reactor Netty 1.3.0 <= 1.3.6

Reactor Netty 1.1.0 <= 1.2.18

Reactor Netty 0 <= 1.0.52

References

https://spring.io/security/cve-2026-47848

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.