CVE-2026-123318

In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine...

CVE-2026-123319

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection...

CVE-2026-123317

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies...

CVE-2026-123319

In JetBrains Ktor versions before 3.6.1 , a vulnerability exists due to missing Domain attribute validation in client cookie storage. This flaw allows for cookie injection . Remediation is available in version 3.6.1 . No specific exploit details or in-the-wild exploitation information are provide...

CVE-2026-123319

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection...

EUVD-2026-118083

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection...

CVE-2026-123318

In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine...

CVE-2026-123318

In JetBrains Ktor versions prior to 3.6.1 , a vulnerability exists in the CIO engine that allows for HTTP request smuggling . This issue is associated with CWE-444 (Inconsistent Interpretation of HTTP Requests). The base severity is MEDIUM (4.8) with a high attack complexity. No specific exploit ...

EUVD-2026-118082

In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine...

CVE-2026-123317

In JetBrains Ktor versions prior to 3.6.1 , a session forgery vulnerability exists. The root cause is an improper validation of integrity check values (CWE-354) within encrypted session cookies , allowing attackers to forge sessions via tampered cookies. This vulnerability has a High severity rat...

EUVD-2026-118081

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies...

CVE-2026-123317: JetBrains Ktor: In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies...

CVE-2026-123319: JetBrains Ktor: In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection...

CVE-2026-123318: JetBrains Ktor: In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine

In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine...

ktor-cve-2023-45612-poc

Ktor XXE Vulnerability Proof-of-Concept CVE-2023-45612 Summary Impact: Arbitrary files access via a crafted XML DTD with an XXE reference. Root cause: Unsafe XML document parser. This repo contains a vulnerable Ktor 2.3.4 app configured to allow external entities so the XXE effect is visible...

cve-2023-45612_exploit

cve-2023-45612exploit CVE-2023-45612 is a high severty security probem that allows XXE XML eXternal Entity attacks on Ktor's XML serialization that has been patched in 2023. Reproduction of the security problem Below is a detailed way of how I reproduced the problem. IntelliJ IDEA project First, ...

ktor-xxe

ktor-xxe Run the project with : | ./gradlew run | Run the server | If the server starts successfully, you'll see the following output: 2024-12-04 14:32:45.584 main INFO Application - Application started in 0.303 seconds. 2024-12-04 14:32:45.682 main INFO Application - Responding at...

ktor-xxe-poc

ktor-xxe-poc This is a proof-of-concept reproducing the security problem CVE-2023-45612. Versions Used Ktor: 2.2.3 xmlutil: 0.84.3 Java: 17.0.6 Gradle: 9.1.0 Python: 3.13.7 How to Run 1. Build and run the server: ./gradlew build ./gradlew run 2. Test the XXE payload : python test.py The server wi...

CVE-2023-45612-PoC

CVE-2023-45612 https://nvd.nist.gov/vuln/detail/CVE-2023-45612 Description of CVE In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE. The vulnerability was patched by @marychatte on Sep 29, 2023 https://github.com/ktorio/ktor/pull/3770...

CVE-2023-45612-PoC

CVE-2023-45612 PoC This repository contains a proof of concept PoC for CVE-2023-45612 which allowed XXE in the default configuration of ContentNegotiation in ktor. The PoC is split into 2 parts: server/, containing an example of a Ktor server using an affected version of Ktor, with an endpoint...