Ktor
This hub aggregates every CVE we track for Ktor, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.
21
CVEs tracked
1
Critical
5
High
0
In CISA KEV
Severity distribution
MEDIUM13HIGH5LOW2CRITICAL1
Monthly trend
0
1
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2024-092026-08
Latest CVEs
The 15 most recently published vulnerabilities affecting Ktor.
- CVE-2025-29904In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible5.3
- CVE-2024-49580In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure5.3
- CVE-2023-45613In JetBrains Ktor before 2.3.5 server certificates were not verified6.8
- CVE-2023-45612In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE8.6
- CVE-2023-34339In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message3.3
- CVE-2022-48476In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible 7.5
- CVE-2022-38180In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases5.3
- CVE-2022-38179JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack4.7
- CVE-2022-29930SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1.8.7
- CVE-2022-29035In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations3.3
- CVE-2021-43203In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.7.5
- CVE-2021-25762In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.5.3
- CVE-2021-25763In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.5.3
- CVE-2021-25761In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.5.3
- CVE-2020-26129In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.6.5
Product normalization is registry-driven with AI assist and human review. How it works