CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect
Reactor Netty WebSocket client leaks credentials during cross-origin redirects if redirect following is enabled, exposing sensitive data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47848?
CVE-2026-47848 is a medium-severity vulnerability in Spring Reactor Netty, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Weakness: CWE-601
Which versions are affected by CVE-2026-47848?
It affects 1 product.
Products include Broadcom Reactor Netty.
How do I fix CVE-2026-47848?
Upgrade to a fixed version.
Is CVE-2026-47848 being exploited?
There is no known exploitation of CVE-2026-47848 in the wild and no public exploit code.
Other vulnerabilities in Spring Reactor Netty
- CVE-2023-34062 In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
- CVE-2019-11284 Reactor Netty authentication leak in redirects
- CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server
- CVE-2020-5404 Authentication Leak On Redirect With Reactor Netty HttpClient
- CVE-2026-47844 Reactor Netty HTTP Server Leaks Exception Details
Sources
Also known as CLEANSTART-2026-DR61127, CLEANSTART-2026-DT37851, CLEANSTART-2026-FE25800, CLEANSTART-2026-GT11567, CLEANSTART-2026-HS68048, GHSA-6p7h-426w-rcrx.