JetBrains

Records788All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical84CVSS 9.0–10.0

CVSS high249CVSS 7.0–8.9

Exploited now

JetBrains records in CISA KEV

TI-2026-45031 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2026-08-05 TI-2024-18054 JetBrains TeamCity Relative Path Traversal Vulnerability CRITICAL 89KEV 2026-04-20 TI-2024-18053 JetBrains TeamCity Authentication Bypass Vulnerability CRITICAL 100KEV 2024-03-07 TI-2023-22884 JetBrains TeamCity Authentication Bypass Vulnerability CRITICAL 100KEV 2023-10-04

Components

Products in the NVD configurations · select one to filter the records

Teamcity 283 records CRITICAL Youtrack 157 records MEDIUM Intellij Idea 77 records HIGH Hub 37 records MEDIUM Ktor 21 records MEDIUM Pycharm 12 records HIGH Toolbox 11 records MEDIUM Rider 9 records HIGH

Records

21 records in Ktor · all components

TI-2023-24413 CVE-2023-45612 · GHSA-q42m-mp58-hxv5

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

MEDIUM 49

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00711 Published 2023-10-09 Fixed in 2.3.5 CWE-611

TI-2019-09527 CVE-2019-12736 · GHSA-7wjj-fwv4-7v29

JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the…

MEDIUM 46

JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0222 Published 2019-10-02 No fix listed CWE-77

TI-2023-24414 CVE-2023-45613 · GHSA-2fvw-ppfc-cm77

In JetBrains Ktor before 2.3.5 server certificates were not verified

MEDIUM 41

In JetBrains Ktor before 2.3.5 server certificates were not verified

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00381 Published 2023-10-09 Fixed in 2.3.5 CWE-295

TI-2022-24056 CVE-2022-48476 · GHSA-pw38-42w8-qm8m

In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible

MEDIUM 40

In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00751 Published 2023-04-24 Fixed in 2.3.0 CWE-35

TI-2022-12277 CVE-2022-29930 · GHSA-52xf-qwx9-xfxq

SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value.

LOW 39

SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00889 Published 2022-05-12 Fixed in 2.0.1 CWE-342

TI-2019-07426 CVE-2019-10102 · GHSA-qw5p-m36f-mv2x

JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0…

LOW 37

JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.0082 Published 2019-07-03 No fix listed CWE-319

TI-2021-19215 CVE-2021-43203 · GHSA-p34x-8gxh-mj58

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.

LOW 34

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00864 Published 2021-11-09 No fix listed CWE-287

TI-2020-04263 CVE-2020-5207 · GHSA-xrr9-rh8p-433v

Request smuggling is possible in Ktor when both chunked TE and content length specified

LOW 34

In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00762 Published 2020-01-27 Fixed in 1.3.0 CWE-444

TI-2025-21289 CVE-2025-29904 · GHSA-cqw7-466v-f9g6

In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

LOW 30

In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0033 Published 2025-03-12 Fixed in 3.1.1 CWE-444

TI-2024-33076 CVE-2024-49580 · GHSA-8qv4-773j-c979

In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure

LOW 30

In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00352 Published 2024-10-17 Fixed in 2.3.13 CWE-524

TI-2022-17874 CVE-2022-38180 · GHSA-hccx-cg4v-hrjx

In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases

LOW 30

In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00755 Published 2022-08-12 Fixed in 2.1.0 CWE-287

TI-2020-15966 CVE-2020-26129 · GHSA-4hv7-632m-j4jc

In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.

LOW 30

In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0077 Published 2020-11-16 No fix listed CWE-444

TI-2022-17873 CVE-2022-38179 · GHSA-v866-gwf5-w92f

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

LOW 28

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00496 Published 2022-08-12 Fixed in 2.1.0 CWE-184

TI-2019-14198 CVE-2019-19703 · GHSA-xwgq-pcqx-hpmv

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.

LOW 28

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00642 Published 2019-12-10 Fixed in 1.3.0 CWE-601

TI-2021-07846 CVE-2021-25762 · GHSA-r26q-7hf9-jh9f

In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.

LOW 26

In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00819 Published 2021-02-03 No fix listed CWE-444

TI-2019-13992 CVE-2019-19389 · GHSA-rm67-h645-8jg2

JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting.

LOW 26

JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0083 Published 2019-12-26 No fix listed CWE-74

TI-2021-07847 CVE-2021-25763 · GHSA-7m4m-xwpv-qmvh

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.

LOW 25

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00548 Published 2021-02-03 No fix listed CWE-327

TI-2021-07845 CVE-2021-25761 · GHSA-w76f-c56x-cr72

In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.

LOW 25

In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00548 Published 2021-02-03 No fix listed CWE-326

TI-2019-09528 CVE-2019-12737 · GHSA-r9px-8w67-f8m8

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with…

LOW 25

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0068 Published 2019-10-02 No fix listed CWE-916

TI-2022-11601 CVE-2022-29035 · GHSA-wh3j-424q-cvpj

In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation…

LOW 17

In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations

CVSS 3.1LOW 3.3 Network High privileges No interaction EPSS 0.00621 Published 2022-04-11 Fixed in 2.0.0 CWE-330

TI-2023-17171 CVE-2023-34339 · GHSA-w2c4-vpgj-g3jp

In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

LOW 15

In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.0021 Published 2023-06-01 Fixed in 2.3.1 CWE-209

Open these records in search →