CVE-2026-123319 · Package
NO FIX YET · SEE WHAT TO DO
Ktor, a Kotlin framework for building web apps and HTTP clients, did not validate the Domain attribute of cookies its client stores. An attacker who can influence responses can inject cookies that the client then sends to other domains.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams whose Kotlin code uses the Ktor HTTP client with its cookie storage enabled and talks to untrusted or third-party hosts. Server-only Ktor apps that never use the client's cookie storage are unlikely to be affected. unknown beyond that.
Not affected if ktor-3.6.1-or-later, no-client-cookie-storage
Who cares jvm, kotlin, ktor
build.gradle.kts or gradle/libs.versions.toml) and see whether the ktor-client artifacts are below 3.6.1.3.6.1: the sources state that versions before 3.6.1 are affected; upgrade to 3.6.1 or later.In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.