ktorio/ktor on GitHub
Framework for quickly creating connected applications in Kotlin with minimal effort
CVE History
| CVE | Published | CVSS v2 | CVSS v3 |
|---|---|---|---|
| CVE-2022-38179 | 6.1 MEDIUM | N/A | |
| JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack | |||
| CVE-2022-38180 | 6.5 MEDIUM | N/A | |
| In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases | |||
| CVE-2022-29930 | 4.9 MEDIUM | 4 MEDIUM | |
| SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1. | |||
| CVE-2022-29035 | 2.7 LOW | 4 MEDIUM | |
| In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations | |||
| CVE-2020-5207 | 7.5 HIGH | 5 MEDIUM | |
| In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator. | |||
| CVE-2019-19389 | 5.4 MEDIUM | 3.5 LOW | |
| JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting. | |||
| CVE-2019-19703 | 6.1 MEDIUM | 5.8 MEDIUM | |
| In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location. | |||