Skip to content
OpenAdvisories

Product · JetBrains

Ktor

14 known vulnerabilities.

Ktor at a glance

Last 12 months
4
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 3 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202630
Oct 202600
Sep 202600
Aug 202610
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202510
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

14 results · Feed

  • Low 3.7
    CVE-2026-123319

    In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

    JetBrains Ktor
  • High 8.1
    CVE-2026-123317

    In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

    JetBrains Ktor
  • Medium 4.8
    CVE-2026-123318

    In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine

    JetBrains Ktor
  • Medium 5.9
    CVE-2026-68762

    In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible

    JetBrains Ktor
  • Medium 5.3
    CVE-2025-29904

    In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

    JetBrains Ktor
  • Medium 5.3
    CVE-2024-49580

    JetBrains Ktor information disclosure

    In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure

    JetBrains Ktor io.ktor:ktor-client-core-jvm Maven
  • Medium 6.8
    CVE-2023-45613

    In JetBrains Ktor before 2.3.5 server certificates were not verified

    JetBrains Ktor
  • High 8.6
    CVE-2023-45612 Public exploit

    In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

    JetBrains Ktor
  • Low 3.3
    CVE-2023-34339

    In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

    JetBrains Ktor
  • High 7.5
    CVE-2022-48476

    In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible

    JetBrains Ktor
  • Medium 5.3
    CVE-2022-38180

    JetBrain Ktor before 2.1.0 vulnerable to selection of wrong authentication provider

    In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases

    JetBrains Ktor io.ktor:ktor Maven
  • Medium 4.7
    CVE-2022-38179

    JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack

    JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

    JetBrains Ktor io.ktor:ktor Maven
  • High 8.7
    CVE-2022-29930

    SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.…

    JetBrains Ktor
  • Low 3.3
    CVE-2022-29035

    In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implem…

    JetBrains Ktor