Description

In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-11-06T11:17:11.317Z",
  "pubdate": "2026-11-06T11:17:11.317Z",
  "executiveSummary": "A critical HTTP request smuggling vulnerability has been identified in the Ktor CIO (Coroutine-based I/O) engine.\nThe vulnerability allows an unauthenticated remote attacker to bypass security controls by manipulating how the HTTP server processes requests.\nThis flaw can lead to unauthorized data access, session hijacking, or cache poisoning, as the server incorrectly interprets request boundaries.\nThe vulnerability affects JetBrains Ktor versions prior to 3.6.1.\nSuccessful exploitation requires the attacker to be able to send crafted HTTP requests to a vulnerable Ktor-based application.\nThe risk implication is high, as it compromises the integrity of the request-response cycle, potentially enabling cross-user data exfiltration and bypassing Web Application Firewall (WAF) or load balancer security policies.",
  "technicalDetails": "The root cause of the HTTP request smuggling vulnerability in the Ktor CIO engine lies in the improper handling and parsing of HTTP headers that define message length, specifically the 'Content-Length' and 'Transfer-Encoding' headers.\nHTTP request smuggling occurs when the front-end (e.g., a load balancer, proxy, or WAF) and the back-end (the Ktor CIO engine) disagree on the boundaries of an HTTP request.\nIn the affected versions of the Ktor CIO engine, the parser may fail to correctly enforce the presence of a single, valid length-specifying header, or it may process ambiguous headers in a way that allows a single TCP connection to carry multiple requests that are interpreted differently by the proxy and the engine.\nWhen an attacker sends a specially crafted request—often utilizing conflicting 'Content-Length' and 'Transfer-Encoding' headers—the proxy may interpret the request using one header while the Ktor CIO engine utilizes the other.\nThis mismatch forces the Ktor engine to see a 'smuggled' prefix of a subsequent request as part of the initial request's body, or conversely, to treat the smuggled data as the start of a completely new, unauthorized request.\nThe attack flow typically follows these steps: First, the attacker sends a malicious request with malformed or conflicting length headers to the target infrastructure. Second, the front-end proxy processes the initial request and forwards the payload to the Ktor engine. Third, due to the parsing flaw in the CIO engine, the engine interprets the boundary of the request prematurely or incorrectly. Fourth, the remaining 'smuggled' data is buffered and concatenated with the next legitimate user's request arriving on the same persistent connection. Finally, the Ktor engine executes the attacker's smuggled command within the context of the subsequent user's session.\nThis flaw enables an attacker to inject arbitrary HTTP headers, perform unauthorized operations on behalf of other users, or bypass authentication mechanisms that rely on request validation at the proxy level. The vulnerability is network-exposed and does not require authentication to trigger. Post-exploitation impact ranges from session theft and data exfiltration to the manipulation of sensitive application-specific workflows."
}