In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases

In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location

In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible

JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting

In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default

In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible

In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials

SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value