{"id":"CVE-2026-47848","aliases":["CLSA-2026-1791529633","CLSA-2026-1791547948","CLSA-2026-1791989666","CLSA-2026-1792505040","CLSA-2026-1793116571","CLSA-2026-1793345120","EUVD-2026-66680","GHSA-6p7h-426w-rcrx"],"status":"published","title":"Reactor Netty WebSocket Client Leaks Credentials On Redirect","description":"In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00261,"percentile":0.17903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-601"],"published":"2026-08-26T19:22:26Z","modified":"2026-11-02T19:46:31Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8}],"products":[{"vendor":"broadcom","product":"reactor_netty"},{"vendor":"spring","product":"reactor netty"},{"vendor":"vmware","product":"reactor netty"}],"references":[{"url":"https://spring.io/security/cve-2026-47848","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47848"},{"url":"https://github.com/advisories/GHSA-6p7h-426w-rcrx"}],"sources":{"cve":[{"id":"CVE-2026-47848","title":"Reactor Netty WebSocket Client Leaks Credentials On Redirect","description":"In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T19:22:26.712Z","modified":"2026-08-26T19:44:38.993Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T13:36:29.327819Z"}],"euvd":[{"id":"EUVD-2026-66680","description":"In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T19:22:26Z","modified":"2026-08-26T19:44:38Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:29.296861Z"}],"ghsa":[{"id":"GHSA-6p7h-426w-rcrx","title":"In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor...","description":"In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T21:31:43Z","modified":"2026-09-04T21:32:44Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:11:24.326884Z"}],"nvd":[{"id":"CVE-2026-47848","description":"In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T20:17:27.07Z","modified":"2026-09-04T19:09:14.543Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CLSA-2026-1791529633","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.1.31-tuxcare.4.","status":"published","published":"2026-10-09T07:07:13Z","modified":"2026-11-02T19:46:27.100145141Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791547948","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.48-tuxcare.5.","status":"published","published":"2026-10-09T12:12:28Z","modified":"2026-11-02T19:46:26.379358987Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791989666","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.2.18-tuxcare.2.","status":"published","published":"2026-10-14T14:54:26Z","modified":"2026-11-02T19:46:27.828680262Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792505040","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.32-tuxcare.6.","status":"published","published":"2026-10-20T14:04:00Z","modified":"2026-11-02T19:46:29.903938891Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793116571","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.1.15-tuxcare.3.","status":"published","published":"2026-10-27T15:56:11Z","modified":"2026-11-02T19:46:31.80652923Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793345120","title":"TuxCare security update for io.projectreactor.netty (8 CVEs)","description":"TuxCare rebuilt 4 io.projectreactor.netty packages to address 8 CVEs. Fixed in 1.0.34-tuxcare.1.","status":"published","published":"2026-10-30T08:25:21Z","modified":"2026-10-30T13:30:08.72554284Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}