KT
Product
Ktor
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 4Medium 13Low 2
Watch
Add Ktor to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-45612 | 9.8 | Oct 9 | In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE Affected: before 2.3.5 |
| CVE-2019-12736 | 9.8 | Oct 2 | JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection Affected: through 1.1.5 |
| CVE-2023-45613 | 9.1 | Oct 9 | In JetBrains Ktor before 2.3.5 server certificates were not verified Affected: before 2.3.5 |
| CVE-2019-10102 | 8.1 | Jul 3 | JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially… Affected: before 1.1.0 |
| CVE-2022-48476 | 7.5 | Apr 24 | In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible Affected: before 2.3.0 |
| CVE-2021-43203 | 7.5 | Nov 9 | In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly Affected: before 1.6.4 |
| CVE-2020-5207 | 7.5 | Jan 27 | In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers… Affected: before 1.3.0 |
| CVE-2022-38180 | 6.5 | Aug 12 | In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases Affected: before 2.1.0 |
| CVE-2020-26129 | 6.5 | Nov 16 | In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible Affected: before 1.4.1 |
| CVE-2022-38179 | 6.1 | Aug 12 | JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack Affected: before 2.1.0 |
| CVE-2019-19703 | 6.1 | Dec 10 | In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location Affected: through 1.2.6 |
| CVE-2026-68762 | 5.9 | Aug 17 | In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible Affected: before 3.4.1 |
| CVE-2019-19389 | 5.4 | Dec 26 | JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting Affected: before 1.2.6 |
| CVE-2025-29904 | 5.3 | Mar 12 | In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible Affected: before 3.1.1 |
| CVE-2024-49580 | 5.3 | Oct 17 | In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure Affected: before 3.0.0 |
| CVE-2021-25763 | 5.3 | Feb 3 | In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default Affected: before 1.4.2 |
| CVE-2021-25762 | 5.3 | Feb 3 | In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible Affected: before 1.4.3 |
| CVE-2021-25761 | 5.3 | Feb 3 | In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible Affected: before 1.5.0 |
| CVE-2019-12737 | 5.3 | Oct 2 | UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials Affected: through 1.1.5; 1.2.0 |
| CVE-2022-29930 | 4.9 | May 12 | SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value Affected: 2.0.0 |
| CVE-2023-34339 | 3.3 | Jun 1 | In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message Affected: before 2.3.1 |
| CVE-2022-29035 | 2.7 | Apr 11 | In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations Affected: before 2.0.0 |
Showing 22