{"id":"CVE-2026-123318","kind":"vulnerability","aliases":["CVE-2026-123318"],"related":[],"title":"Ktor CIO engine: HTTP request smuggling possible before version 3.6.1","description":"In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine","summary":"Before Ktor 3.6.1, the CIO engine in JetBrains' Kotlin web framework could be tricked into request smuggling. An attacker can slip hidden requests past a front-end proxy and reach back-end logic they should not see.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jvm","kotlin","ktor","package","self-hosted"],"not_affected_if":["ktor-3.6.1-or-later","no-front-proxy","non-cio-engine"],"how_to_check":"- Check the Ktor version in the build file (Gradle or Maven) and confirm it is 3.6.1 or later.\n- Look for the CIO engine (`io.ktor:ktor-server-cio`) in the server dependencies.","fix":"- Ktor: `3.6.1`\n- Earlier versions are affected.","status":"open","published_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","triaged_at":"2026-11-06T11:42:39+00:00","updated_at":"2026-11-06T11:42:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T11:42:39Z","model":"claude-haiku-5-5","output":{"fix":"- Ktor: `3.6.1`\n- Earlier versions are affected.","reach":"internet","title":"Ktor CIO engine: HTTP request smuggling possible before version 3.6.1","impact":"medium","summary":"Before Ktor 3.6.1, the CIO engine in JetBrains' Kotlin web framework could be tricked into request smuggling. An attacker can slip hidden requests past a front-end proxy and reach back-end logic they should not see.","audience":"developers","category":"package","nicknames":[],"who_cares":["ktor","kotlin","jvm","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker smuggles requests past the proxy to reach internal endpoints","analyst_note":"","how_to_check":"- Check the Ktor version in the build file (Gradle or Maven) and confirm it is 3.6.1 or later.\n- Look for the CIO engine (`io.ktor:ktor-server-cio`) in the server dependencies.\n- unknown for anything beyond this, the sources do not say.","plain_action":"","needs_analyst":false,"not_affected_if":["ktor-3.6.1-or-later","non-cio-engine","no-front-proxy"],"who_is_affected":"Services built on Ktor that use the CIO engine and sit behind a reverse proxy or load balancer are the ones at risk. Apps using other Ktor engines, or those with no proxy in front, are less exposed. The sources do not give further detail.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4162,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123318':13A,16A '-2026':12A,15A '3.6.1':10A,26B,67C 'attack':42B 'back':56B 'back-end':55B 'cio':2A,28B,75C 'could':35B 'cve':11A,14A 'end':51B,57B 'engin':3A,29B,76C 'framework':34B 'front':50B 'front-end':49B 'hidden':45B 'host':23B 'http':4A,68C 'jetbrain':31B,64C 'jvm':17B 'kotlin':18B,32B 'ktor':1A,19B,25B,65C 'logic':58B 'packag':20B 'past':47B 'possibl':7A,72C 'proxi':52B 'reach':54B 'request':5A,39B,46B,69C 'see':62B 'self':22B 'self-host':21B 'slip':44B 'smuggl':6A,40B,70C 'trick':37B 'version':9A 'web':33B","nicknames":[],"mitigations":[],"who_affected":"Services built on Ktor that use the CIO engine and sit behind a reverse proxy or load balancer are the ones at risk. Apps using other Ktor engines, or those with no proxy in front, are less exposed. The sources do not give further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jvm","kotlin","ktor","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-123318':13A,16A '-2026':12A,15A '3.6.1':10A 'cio':2A 'cve':11A,14A 'engin':3A 'http':4A 'ktor':1A 'possibl':7A 'request':5A 'smuggl':6A 'version':9A","search_b":"'3.6.1':26B 'attack':42B 'back':56B 'back-end':55B 'cio':28B 'could':35B 'end':51B,57B 'engin':29B 'framework':34B 'front':50B 'front-end':49B 'hidden':45B 'host':23B 'jetbrain':31B 'jvm':17B 'kotlin':18B,32B 'ktor':19B,25B 'logic':58B 'packag':20B 'past':47B 'proxi':52B 'reach':54B 'request':39B,46B 'see':62B 'self':22B 'self-host':21B 'slip':44B 'smuggl':40B 'trick':37B 'web':33B","search_c":"'3.6.1':67C 'cio':75C 'engin':76C 'http':68C 'jetbrain':64C 'ktor':65C 'possibl':72C 'request':69C 'smuggl':70C","first_public_at":"2026-11-06T11:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123318","severity":null,"published_at":"2026-11-06T11:17:11+00:00","modified_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","fetched_at":"2026-11-06T11:41:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}