Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreReactor Netty WebSocket Client Leaks Credentials On Redirect
Description
In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected Spring Products and Versions
Reactor Netty:
- 1.3.0 - 1.3.6
- 1.1.0 - 1.2.18
- 1.0.52 and earlier
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Fix version | Availability |
|---|---|
| 1.3.7 | OSS |
| 1.3.6.1 | Enterprise Support Only |
| 1.2.19 | Enterprise Support Only |
| 1.0.53 | Enterprise Support Only |
No further mitigation steps are necessary.
Credit
The issue was identified internally and later responsibly reported by
- Yu Bao from PayPal Cyber Security Team
- Arpit Jain - https://github.com/arpitjain099
History
- 2026-08-20: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all