CVE-2026-47848 Spring CVE debrief

Who should care

Developers and administrators using Reactor Netty WebSocket client, especially those with WebSocket-based applications handling sensitive credentials, should be aware of this vulnerability and take necessary precautions to prevent potential credential leaks. This includes reviewing and updating their configurations, monitoring for suspicious activity, and implementing compensating controls for WebSocket authentication.

Technical summary

The Reactor Netty WebSocket client may leak credentials in specific scenarios involving WebSocket handshake redirects to a different origin when the HTTP client is explicitly configured to follow redirects. This vulnerability affects Reactor Netty versions 1.3.0 - 1.3.6, 1.1.0 - 1.2.18, and 1.0.52 and earlier. The leak occurs due to the client's handling of redirects, which can lead to sensitive credentials being exposed. Developers should review their applications and update to the latest versions to mitigate this vulnerability.

Defensive priority

Medium-priority defensive review recommended due to potential credential leak in Reactor Netty WebSocket client.

Recommended defensive actions

• Review and update Reactor Netty to version 1.3.6.1 or later
• Verify HTTP client configuration to prevent redirect following
• Monitor for suspicious WebSocket activity
• Implement compensating controls for WebSocket authentication
• Conduct a thorough review of WebSocket-based applications for potential credential leaks
• Update documentation to reflect changes in WebSocket client configurations
• Perform regular security audits to detect and address potential vulnerabilities

Evidence notes

Evidence from official CVE and NVD sources indicates potential credential leak in Reactor Netty WebSocket client when HTTP client is configured to follow redirects. Affected versions include Reactor Netty 1.3.0 - 1.3.6, 1.1.0 - 1.2.18, and 1.0.52 and earlier. The vulnerability is related to WebSocket handshake redirects to a different origin. Defenders should verify their configurations and update to the latest versions to mitigate this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.