{"id":"CVE-2026-123318","aliases":["EUVD-2026-118082","GHSA-6mmc-8ffm-69rw"],"status":"published","title":"In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine","description":"In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00146,"percentile":0.03864,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-444"],"published":"2026-11-06T10:28:04Z","modified":"2026-11-06T12:30:42Z","products":[{"vendor":"jetbrains","product":"ktor"}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123318"},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed"},{"url":"https://github.com/advisories/GHSA-6mmc-8ffm-69rw"}],"sources":{"cve":[{"id":"CVE-2026-123318","description":"In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine","status":"published","published":"2026-11-06T10:28:04.88Z","modified":"2026-11-10T17:51:53.16Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-10T18:39:47.416646Z"}],"euvd":[{"id":"EUVD-2026-118082","description":"In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine","status":"published","published":"2026-11-06T10:28:04Z","modified":"2026-11-10T17:51:53Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-10T19:22:12.693108Z"}],"ghsa":[{"id":"GHSA-6mmc-8ffm-69rw","title":"In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine","description":"In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine","status":"published","published":"2026-11-06T12:30:41Z","modified":"2026-11-06T12:30:42Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-06T13:00:04.317934Z"}],"nvd":[{"id":"CVE-2026-123318","description":"In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine","status":"published","published":"2026-11-06T11:17:11.317Z","modified":"2026-11-10T18:17:22.997Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-07T00:02:36.552517Z"}]}}