CVE-2026-47848

Received Received - Intake

WebSocket Credential Leak in Reactor Netty

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VMware

Description

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-47848

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	reactor_netty	From 1.3.0 (inc) to 1.3.6 (inc)
vmware	reactor_netty	From 1.1.0 (inc) to 1.2.18 (inc)
vmware	reactor_netty	to 1.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the Reactor Netty WebSocket client leaking credentials during WebSocket handshake redirects to a different origin. It only occurs if the HTTP client was explicitly configured to follow redirects.

Detection Guidance

This vulnerability involves WebSocket handshake redirects leaking credentials when HTTP client follows redirects. To detect it, monitor network traffic for WebSocket connections with redirect responses (HTTP 3xx) and check if credentials are included in headers or URLs. Inspect logs for Reactor Netty versions 1.0.52 or earlier, 1.1.0-1.2.18, or 1.3.0-1.3.6.

Impact Analysis

An attacker could intercept leaked credentials during a WebSocket handshake redirect, potentially gaining unauthorized access to sensitive data or systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality.

Mitigation Strategies

Disable automatic redirect following in the HTTP client configuration for Reactor Netty. Update to a patched version of Reactor Netty if available. Monitor network traffic for unauthorized credential leaks during WebSocket handshakes.

Hi! I’m here to help you understand CVE-2026-47848. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70