JetBrains Ktor vulnerabilities

CVEs per yearBy the year they were published

1. 20224
2. 20234
3. 20241
4. 20251
5. 20264

Newest CVEs

• CVE-2026-123319

  In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

  JetBrains · Ktor

  Low3.7
• CVE-2026-123318

  In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine

  JetBrains · Ktor

  Medium4.8
• CVE-2026-123317

  In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

  JetBrains · Ktor

  High8.1
• CVE-2026-68762

  In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible

  JetBrains · Ktor

  Medium5.9
• CVE-2025-29904

  In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

  JetBrains · Ktor

  Medium5.3
• CVE-2024-49580

  In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure

  JetBrains · Ktor

  Medium5.3
• CVE-2023-45613

  In JetBrains Ktor before 2.3.5 server certificates were not verified

  JetBrains · Ktor

  Medium6.8
• CVE-2023-45612

  In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

  JetBrains · Ktor

  High8.6
• CVE-2023-34339

  In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

  JetBrains · Ktor

  Low3.3
• CVE-2022-48476

  In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible

  JetBrains · Ktor

  High7.5