Executive brief
Reactor Netty is a network I/O library used by Spring applications to handle WebSocket connections. When the WebSocket client is configured to automatically follow redirects and encounters a redirect to a different origin, credentials (such as authentication tokens or cookies) can be inadvertently sent to the new origin, exposing sensitive authentication data to a third party.
Technical details
This vulnerability is a credential disclosure flaw in Reactor Netty's WebSocket client handling of HTTP redirects. When the client is explicitly configured to follow redirects and receives a 3xx HTTP response during WebSocket handshake that points to a different origin, the library fails to strip credentials before re-issuing the request to the new target. An attacker can trigger this by hosting a malicious endpoint that performs a redirect to a different domain, causing the victim's HTTP client to leak authorization headers or session cookies. The vulnerability affects Reactor Netty versions 1.0.52 and earlier, 1.1.0–1.2.18, and 1.3.0–1.3.6.
Affected products
- Spring Reactor Netty 1.0.52 and earlier; 1.1.0–1.2.18; 1.3.0–1.3.6
Timeline
- 2026-08-26: disclosed