1. Home
  2. CVE Database
  3. CVE-2026-47848
MEDIUM · 6.1

CVE-2026-47848

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have bee...

Vulnerability Description

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
BroadcomReactor Netty< 1.0.53

Related Weaknesses (CWE)

CWE-601

References

FAQ

What is CVE-2026-47848?

CVE-2026-47848 is a vulnerability with a CVSS score of 6.1 (MEDIUM). In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have bee...

How severe is CVE-2026-47848?

CVE-2026-47848 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-47848?

Check the references section above for vendor advisories and patch information. Affected products include: Broadcom Reactor Netty.