Ktor
22 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Ktor, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.
Ktor CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 1 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 1 |
| 2026-09 | 0 |
Severity
How the 22 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High5
- Medium14
- Low2
Latest CVEs
The 15 most recently published vulnerabilities affecting Ktor.
- CVE-2026-68762In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible5.9
- CVE-2025-29904In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible5.3
- CVE-2024-49580In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure5.3
- CVE-2023-45613In JetBrains Ktor before 2.3.5 server certificates were not verified6.8
- CVE-2023-45612In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE8.6
- CVE-2023-34339In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message3.3
- CVE-2022-48476In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible 7.5
- CVE-2022-38180In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases5.3
- CVE-2022-38179JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack4.7
- CVE-2022-29930SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1.8.7
- CVE-2022-29035In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations3.3
- CVE-2021-43203In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.7.5
- CVE-2021-25762In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.5.3
- CVE-2021-25763In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.5.3
- CVE-2021-25761In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.5.3
Product grouping is registry-driven, with AI assist and human review. How it works