---
id: "CVE-2026-123319"
page: "https://infrastack.ai/live/CVE-2026-123319"
kind: "vulnerability"
aliases: ["CVE-2026-123319"]
title: "Ktor client: missing cookie Domain validation allows cookie injection"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jvm", "kotlin", "ktor", "package"]
not_affected_if: ["ktor-3.6.1-or-later", "no-client-cookie-storage"]
published_at: "2026-11-06T11:17:11+00:00"
first_seen_at: "2026-11-06T11:41:26+00:00"
updated_at: "2026-11-06T11:42:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123319", "first_seen_at": "2026-11-06T11:41:26+00:00"}]
exploit_sources: []
---

# Ktor client: missing cookie Domain validation allows cookie injection

Link for people: https://infrastack.ai/live/CVE-2026-123319 (this .md is for agents)

Ktor, a Kotlin framework for building web apps and HTTP clients, did not validate the Domain attribute of cookies its client stores. An attacker who can influence responses can inject cookies that the client then sends to other domains.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Ktor version in the build file (for example `build.gradle.kts` or `gradle/libs.versions.toml`) and see whether the `ktor-client` artifacts are below `3.6.1`.

## Fix

- Ktor `3.6.1`: the sources state that versions before 3.6.1 are affected; upgrade to `3.6.1` or later.

## Timeline

- 2026-11-06T11:41:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123319

## From the sources

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_