Jetbrains Ktor vulnerabilities

• jetbrains ktor In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage... CVE-2026-123319 3.7 LowNovember 6, 2026
• jetbrains ktor In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine CVE-2026-123318 4.8 MediumNovember 6, 2026
• jetbrains ktor In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies CVE-2026-123317 8.1 HighNovember 6, 2026
• jetbrains ktor In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible CVE-2026-68762 5.9 MediumAugust 17, 2026
• jetbrains ktor In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible CVE-2025-29904 5.3 MediumMarch 12, 2025
• jetbrains ktor JetBrains Ktor information disclosure CVE-2024-49580 Fix available 5.3 MediumOctober 17, 2024
• jetbrains ktor In JetBrains Ktor before 2.3.5 server certificates were not verified CVE-2023-45613 6.8 MediumOctober 9, 2023
• jetbrains ktor In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was... CVE-2023-45612 Public exploit 8.6 HighOctober 9, 2023
• jetbrains ktor In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the... CVE-2023-34339 3.3 LowJune 1, 2023
• jetbrains ktor In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible CVE-2022-48476 7.5 HighApril 24, 2023
• jetbrains ktor JetBrain Ktor before 2.1.0 vulnerable to selection of wrong authentication provider CVE-2022-38180 Fix available 5.3 MediumAugust 12, 2022
• jetbrains ktor JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack CVE-2022-38179 Fix available 4.7 MediumAugust 12, 2022
• jetbrains ktor SHA1 implementation in JetBrains Ktor Native before 2.0.1 was returning the same value CVE-2022-29930 8.7 HighMay 12, 2022
• jetbrains ktor In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't... CVE-2022-29035 3.3 LowApril 11, 2022
• jetbrains ktor In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is... CVE-2021-43203 7.5 HighNovember 9, 2021
• jetbrains ktor In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible. CVE-2021-25762 5.3 MediumFebruary 3, 2021
• jetbrains ktor In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default. CVE-2021-25763 5.3 MediumFebruary 3, 2021
• jetbrains ktor In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible. CVE-2021-25761 5.3 MediumFebruary 3, 2021
• jetbrains ktor In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible. CVE-2020-26129 6.5 MediumNovember 16, 2020
• jetbrains ktor Request smuggling is possible in Ktor when both chunked TE and content length specified CVE-2020-5207 Fix available 5.4 MediumJanuary 27, 2020
• jetbrains ktor Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) in Ktor CVE-2019-19389 5.4 MediumDecember 26, 2019
• jetbrains ktor URL Redirection to Untrusted Site (Open Redirect) in Ktor CVE-2019-19703 Fix available 6.1 MediumDecember 10, 2019
• jetbrains ktor JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for... CVE-2019-12736 9.8 CriticalOctober 2, 2019
• jetbrains ktor UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a... CVE-2019-12737 5.3 MediumOctober 2, 2019
• jetbrains kotlin, ktor +1 more JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were... CVE-2019-10102 8.1 HighJuly 3, 2019