Ktor vulnerabilities
CVEs whose affected-version data names the Ktor package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-123318Medium· 4.8In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
▾ SunlitJetBrains · Ktorvia CVEORG
CVE-2026-123317High· 8.1In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
▾ TwilightJetBrains · Ktorvia CVEORG
CVE-2026-123319Low· 3.7In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
▾ SunlitJetBrains · Ktorvia CVEORG