CVEvulnerability

CVE-2026-47848

6.1 MEDIUM Published 2026-08-26 Modified 2026-09-04 Official page ↗
Status
Analyzed
Published
2026-08-26
Last modified
2026-09-04
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601

Description

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

Affected configurations

• broadcom reactor netty (< 1.0.53) • broadcom reactor netty (>= 1.1.0 < 1.2.19) • broadcom reactor netty (>= 1.3.0 < 1.3.6.1)

Related

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References