CVE-2026-47848: Reactor Netty WebSocket Client Leaks Credentials On Redirect
In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Reactor Netty WebSocket client deployments are affected, and only when the underlying HTTP client has been explicitly configured to follow redirects. The vulnerable behavior requires a WebSocket handshake redirect to a different origin.
What must an attacker or malicious endpoint do to trigger credential exposure?
The WebSocket handshake must be redirected to a different origin while redirect following is enabled. Exploitation also requires a user interaction, as reflected by the UI:R vector.
How can I determine whether my application may be affected?
Review WebSocket client configuration for explicit HTTP redirect following, then identify whether handshake endpoints can redirect clients to another origin. Versions 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 or earlier are listed as affected.
What can be done if updating is not immediately possible?
Disable redirect following for the HTTP client used by the Reactor Netty WebSocket client, or prevent WebSocket handshake redirects to different origins. This removes the stated condition required for credential leakage.