Patch Ticker

Ktor session cookie forgery and HTTP request smuggling flaws

Programs built with the Kotlin web framework can have logins forged.

Summary

JetBrains Ktor before 3.6.1 has flaws allowing session forgery, HTTP request smuggling and cookie injection. Programs built with Ktor are affected.

What to do

Update Ktor to 3.6.1 or later.

Products and platforms

  • Ktor

CVE IDs

Sources

Times

First published

First seen