Ktor (Jetbrains) - vulnerabilities (CVEs)
21 CVEs, 0 in the last 30 days, 163 known versions, newest CVE from 2026-08-17. Vendor: Jetbrains.
CVEs of Ktor
- CVE-2026-68762 - CVSS 5.9 (medium), 2026-08-17: In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible
- CVE-2025-29904 - CVSS 5.3 (medium), 2025-03-12: In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible
- CVE-2024-49580 - CVSS 5.3 (medium), 2024-10-17: In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure
- CVE-2023-45612 - CVSS 9.8 (critical), 2023-10-09: In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE
- CVE-2023-45613 - CVSS 9.1 (critical), 2023-10-09: In JetBrains Ktor before 2.3.5 server certificates were not verified
- CVE-2023-34339 - CVSS 3.3 (low), 2023-06-01: In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message
- CVE-2022-48476 - CVSS 7.5 (high), 2023-04-24: In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible
- CVE-2022-38180 - CVSS 6.5 (medium), 2022-08-12: In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases
- CVE-2022-38179 - CVSS 6.1 (medium), 2022-08-12: JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack
- CVE-2022-29930 - CVSS 8.7 (high), 2022-05-12: SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1.
- CVE-2022-29035 - CVSS 3.3 (low), 2022-04-11: In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations
- CVE-2021-43203 - CVSS 7.5 (high), 2021-11-09: In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.
- CVE-2021-25762 - CVSS 5.3 (medium), 2021-02-03: In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.
- CVE-2021-25761 - CVSS 5.3 (medium), 2021-02-03: In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.
- CVE-2021-25763 - CVSS 5.3 (medium), 2021-02-03: In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.
- CVE-2020-26129 - CVSS 6.5 (medium), 2020-11-16: In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.
- CVE-2020-5207 - CVSS 7.5 (high), 2020-01-27: In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't…
- CVE-2019-19389 - CVSS 5.4 (medium), 2019-12-26: JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting.
- CVE-2019-19703 - CVSS 6.1 (medium), 2019-12-10: In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.
- CVE-2019-12737 - CVSS 5.3 (medium), 2019-10-02: UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.
- CVE-2019-12736 - CVSS 9.8 (critical), 2019-10-02: JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection.
- CVE-2019-10102 - CVSS 8.1 (high), 2019-07-03: JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build…
