Description
In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Reactor Netty 1.3.0 - 1.3.6
Reactor Netty 1.1.0 - 1.2.18
Reactor Netty 1.0.52 and earlier
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Reactor Netty | 1.3.0 – ≤ 1.3.6, 1.1.0 – ≤ 1.2.18, ≤ 1.0.52 | — |