CVE-2019-10102

CVE-2019-10102 affects JetBrains/Ktor-related tooling (Kotlin IDE template) before version 1.1.0, where artifacts were resolved over http during build, enabling potential MITM attacks. This vulnerability is addressed in the Kotlin plugin fix release 1.3.30; affected branches rely on prior Kotlin ...

CVE-2022-38179

JetBrains Ktor prior to 2.1.0 is affected by a Reflect File Download (RFD) vulnerability. The issue stems from improper encoding of the Content-Disposition filename parameter, enabling an attacker to trigger untrusted file downloads. Multiple sources confirm the affected product/version and descr...

CVE-2022-29930

CVE-2022-29930 affects JetBrains Ktor Native 2.0.0, where the SHA1 implementation returned the same value due to a faulty hashing function. The issue has been fixed in Ktor 2.0.1. Public references from NVD/Red Hat OSV and related sources corroborate the fix version and the affected component. If...

CVE-2019-19389

CVE-2019-19389 affects JetBrains Ktor framework prior to version 1.2.6 and is described as an HTTP Response Splitting vulnerability. Red Hat and CNVD entries corroborate the same flaw, with JetBrains’ Q4 2019 security bulletin listing Ktor as affected and noting the issue is resolved in version 1...

CVE-2025-29904

CVE-2025-29904 : JetBrains Ktor before 3.1.1 is vulnerable to HTTP Request Smuggling. The issue affects Ktor’s HTTP handling prior to 3.1.1. Remediation: upgrade to 3.1.1 or newer (per Nessus/Snyk analyses and vendor advisories).

CVE-2020-5207

Kotlin Ktor before 1.3.0 is affected by a request-smuggling issue when behind proxies that mishandle Content-Length/Transfer-Encoding or use an improper header separator. The vulnerability arises from how multiple proxy configurations may allow CRLF or header separator handling to be exploited. I...

CVE-2022-38180

CVE-2022-38180 affects JetBrains Ktor prior to 2.1.0. The issue is a misselection of the authentication provider in some cases, due to the wrong provider being chosen. The CVSS metrics indicate a High confidentiality impact with no integrity/availability impact, and there is a network attack vect...

CVE-2022-29035

JetBrains Ktor Native prior to version 2.0.0 is affected by a weakness in nonce generation where random values were not produced using SecureRandom. The connected documents confirm the root cause but do not provide detailed vulnerability specifics or explicit remediation beyond the product versio...

CVE-2024-49580

The CVE-2024-49580 issue affects JetBrains Ktor, specifically the HttpCache Plugin, due to improper caching that can disclose response information. Affected products/versions include Ktor before 2.3.13 (and, per PT-Security, before 3.0.0 for related caching behavior). The documented impact is inf...

CVE-2019-19703

The CVE-2019-19703 entry concerns the Ktor framework (through version 1.2.6) where the client resends data from the HTTP Authorization header to a redirect location, creating an open-redirect risk. Connected sources (Red Hat, GitHub advisories, OSV, and CVE lists) consistently describe this Issue...

CVE-2023-45613

The CVE-2023-45613 entry concerns JetBrains Ktor prior to 2.3.5 where server certificates are not verified, creating a trust-management vulnerability. The Red Hat/EUVD/OSV/etc. entries and PT-2023-29593 describe the issue consistently as a failure to validate server certificates in Ktor versions ...

CVE-2022-48476

In JetBrains Ktor, prior to version 2.3.0, there is a path traversal vulnerability in the resolveResource method. Affected software is Ktor (JetBrains’ framework); root cause per sources is a path traversal flaw in resolveResource. The CVE is linked across multiple feeds (NVD/Red Hat/OSV/etc.). I...

CVE-2023-45612

CVE-2023-45612 affects JetBrains Ktor with the ContentNegotiation XML format enabled in versions before 2.3.5. The root cause is an insecure default XML configuration that allows external entity processing, enabling XXE. Exploitation can lead to file disclosure (e.g., reading server files) and SS...

CVE-2019-12736

CVE-2019-12736 affects JetBrains Kotlin Ktor framework prior to 1.2.0-rc, where the LDAP username is not sanitized, enabling command injection. Impact described as significant; next steps require upgrading to 1.2.0-rc or 1.2.0 (fixes included). If exploitation details are not provided in the sour...

CVE-2021-25762

CVE-2021-25762 details (concrete): In JetBrains Ktor before 1.4.3, an HTTP Request Smuggling vulnerability exists. The issue affects the Ktor component of JetBrains products prior to version 1.4.3, as documented in multiple feeds including Red Hat and CVE databases, and was listed in JetBrains Se...

CVE-2021-25763

CVE-2021-25763 affects JetBrains Ktor prior to 1.4.2, where weak cipher suites were enabled by default in the framework. The issue is described as a default configuration flaw in Ktor’s crypto settings, potentially enabling weaker ciphers for connections. Public reports confirm the vulnerable ver...

CVE-2021-43203

CVE-2021-43203 affects JetBrains Ktor prior to 1.6.4, where nonce verification in the OAuth2 authentication flow is implemented improperly. This can undermine the integrity of the OAuth2 nonce check, exposing an authentication risk as described in multiple sources (Red Hat and CNVD mirrors) and s...

CVE-2019-12737

CVE-2019-12737 affects JetBrains Kotlin Ktor framework prior to 1.2.0-rc, where UserHashedTableAuth stores credentials using a one-way hash with a predictable salt. This weakens credential protection and aligns with the NVD CVSS 2.0/3.1 scores (base ~5.0–5.3, MEDIUM). The issue is documented acro...

CVE-2020-26129

CVE-2020-26129 affects JetBrains Ktor before 1.4.1. Multiple sources (NVD entry and connected vendor/security advisories) describe a vulnerability where HTTP request smuggling is possible in affected versions. Details consistently identify the vulnerable component as the Ktor HTTP handling stack ...

CVE-2021-25761

JetBrains Ktor versions before 1.5.0 are affected by CVE-2021-25761, described as a birthday attack on the SessionStorage key. The issue could enable exploitation of the SessionStorage key, with the affected component being Ktor’s SessionStorage handling. The remediation is to upgrade to Ktor 1.5...

CVE-2023-34339

CVE-2023-34339 affects JetBrains Ktor prior to 2.3.1. The issue is that headers containing authentication data could be added to exception messages, enabling potential exposure of sensitive information. Multiple connected sources (Red Hat, Veracode, CVE lists) confirm the same impact and scope. T...