CVE-2026-47848

CVE-2026-47848 affects the Reactor Netty WebSocket client (versions 1.0.52 and earlier , 1.1.0–1.2.18 , and 1.3.0–1.3.6 ). In specific scenarios where a WebSocket handshake is redirected to a different origin , the client may leak credentials to the redirected origin. The condition requires the H...

CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 -...