Read the docs
TI-2022-11601 Aliases CVE-2022-29035GHSA-wh3j-424q-cvpj

In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation…

Priority LOW 17CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations

Why it matters now

EPSS 0.00621 50th percentileScored 2026-11-07
Fix Fixed Ktor (JetBrains): 2.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JetBrainsKtor2.0.0 to before 2.0.02.0.0Patch availableCNA
  • Ktor VendorJetBrains Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jetbrains:ktor:*:*:*:*:*:*:*:*before 2.0.0VulnerableJetBrains
  • cpe:2.3:a:jetbrains:ktor:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·JetBrains

Remediation

  • Fix · CNA Ktor (JetBrains) Fixed in 2.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29035
  2. 2026-10-03 Alias added: GHSA-wh3j-424q-cvpj
  3. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Patch 2

  • TI-2023-24413 In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE CVSS 3.1CRITICAL 9.8
  • TI-2019-09527 JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the… CVSS 3.1CRITICAL 9.8
  • TI-2023-24414 In JetBrains Ktor before 2.3.5 server certificates were not verified CVSS 3.1CRITICAL 9.1
  • TI-2022-24056 In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible CVSS 3.1HIGH 7.5
  • TI-2022-12277 SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. CVSS 3.1HIGH 8.7
  • TI-2019-07426 JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0… CVSS 3.0HIGH 8.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences