Vulnerabilities

TI-2026-85860 CVE-2026-123319 · GHSA-2qr9-2f88-gccj

Cookie injection in JetBrains Ktor client cookie storage

LOW 17

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00162 Published 2026-11-06 Fixed in 3.6.1 CWE-565

TI-2026-85859 CVE-2026-123318 · GHSA-6mmc-8ffm-69rw

LOW 21

In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00146 Published 2026-11-06 Fixed in 3.6.1 CWE-444

TI-2026-85858 CVE-2026-123317 · GHSA-76h9-4mx5-8c9v

LOW 37

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00204 Published 2026-11-06 Fixed in 3.6.1 CWE-354