{"id":"CVE-2026-123319","kind":"vulnerability","aliases":["CVE-2026-123319"],"related":[],"title":"Ktor client: missing cookie Domain validation allows cookie injection","description":"In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection","summary":"Ktor, a Kotlin framework for building web apps and HTTP clients, did not validate the Domain attribute of cookies its client stores. An attacker who can influence responses can inject cookies that the client then sends to other domains.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jvm","kotlin","ktor","package"],"not_affected_if":["ktor-3.6.1-or-later","no-client-cookie-storage"],"how_to_check":"- Check the Ktor version in the build file (for example `build.gradle.kts` or `gradle/libs.versions.toml`) and see whether the `ktor-client` artifacts are below `3.6.1`.","fix":"- Ktor `3.6.1`: the sources state that versions before 3.6.1 are affected; upgrade to `3.6.1` or later.","status":"open","published_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","triaged_at":"2026-11-06T11:42:44+00:00","updated_at":"2026-11-06T11:42:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T11:42:44Z","model":"claude-haiku-5-5","output":{"fix":"- Ktor `3.6.1`: the sources state that versions before 3.6.1 are affected; upgrade to `3.6.1` or later.","reach":"unknown","title":"Ktor client: missing cookie Domain validation allows cookie injection","impact":"low","summary":"Ktor, a Kotlin framework for building web apps and HTTP clients, did not validate the Domain attribute of cookies its client stores. An attacker who can influence responses can inject cookies that the client then sends to other domains.","audience":"developers","category":"package","nicknames":[],"who_cares":["ktor","kotlin","jvm"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker-set cookies get sent to unrelated domains by the client","analyst_note":"","how_to_check":"- Check the Ktor version in the build file (for example `build.gradle.kts` or `gradle/libs.versions.toml`) and see whether the `ktor-client` artifacts are below `3.6.1`.","plain_action":"","needs_analyst":false,"not_affected_if":["ktor-3.6.1-or-later","no-client-cookie-storage"],"who_is_affected":"Teams whose Kotlin code uses the Ktor HTTP client with its cookie storage enabled and talks to untrusted or third-party hosts. Server-only Ktor apps that never use the client's cookie storage are unlikely to be affected. unknown beyond that.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000688,"input_tokens":4173,"output_tokens":542,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123319':12A,15A '-2026':11A,14A '3.6.1':63C 'allow':7A,72C 'app':27B 'attack':43B 'attribut':36B,66C 'build':25B 'client':2A,30B,40B,53B,69C 'cooki':4A,8A,38B,50B,70C,73C 'cve':10A,13A 'domain':5A,35B,58B,65C 'framework':23B 'http':29B 'influenc':46B 'inject':9A,49B,74C 'jetbrain':60C 'jvm':16B 'kotlin':17B,22B 'ktor':1A,18B,20B,61C 'miss':3A,64C 'packag':19B 'respons':47B 'send':55B 'storag':71C 'store':41B 'valid':6A,33B,67C 'web':26B","nicknames":[],"mitigations":[],"who_affected":"Teams whose Kotlin code uses the Ktor HTTP client with its cookie storage enabled and talks to untrusted or third-party hosts. Server-only Ktor apps that never use the client's cookie storage are unlikely to be affected. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jvm","kotlin","ktor","low","package"],"campaign_type":null,"search_a":"'-123319':12A,15A '-2026':11A,14A 'allow':7A 'client':2A 'cooki':4A,8A 'cve':10A,13A 'domain':5A 'inject':9A 'ktor':1A 'miss':3A 'valid':6A","search_b":"'app':27B 'attack':43B 'attribut':36B 'build':25B 'client':30B,40B,53B 'cooki':38B,50B 'domain':35B,58B 'framework':23B 'http':29B 'influenc':46B 'inject':49B 'jvm':16B 'kotlin':17B,22B 'ktor':18B,20B 'packag':19B 'respons':47B 'send':55B 'store':41B 'valid':33B 'web':26B","search_c":"'3.6.1':63C 'allow':72C 'attribut':66C 'client':69C 'cooki':70C,73C 'domain':65C 'inject':74C 'jetbrain':60C 'ktor':61C 'miss':64C 'storag':71C 'valid':67C","first_public_at":"2026-11-06T11:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123319","severity":null,"published_at":"2026-11-06T11:17:11+00:00","modified_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","fetched_at":"2026-11-06T11:41:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}