Description

In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-17T16:17:30.237Z",
  "pubdate": "2026-08-17T16:17:30.237Z",
  "executiveSummary": "A denial of service vulnerability exists within JetBrains Ktor before version 3.4.1, specifically affecting WebSocket decompression mechanisms.\nThe vulnerability allows remote threat actors to trigger excessive resource consumption on vulnerable servers, leading to service degradation or complete application unavailability.\nThe flaw impacts applications utilizing JetBrains Ktor for handling WebSocket connections with decompression enabled.\nRisk implications include potential service outages and disruption of dependent network operations.\nAttackers require network access to the WebSocket endpoint to deliver crafted payloads, with no specific prior authentication or elevated privileges required to initiate the attack vector.\nExploitation relies on sending specifically designed compressed WebSocket frames that maximize CPU or memory utilization upon decompression processing by the vulnerable server.",
  "technicalDetails": "The root cause of the vulnerability resides in the WebSocket decompression handling routines within JetBrains Ktor prior to version 3.4.1.\nWhen processing incoming WebSocket frames containing compressed data, the affected component fails to adequately bound resource allocation or validate decompression expansion ratios.\nThe vulnerable component is the WebSocket frame processing and decompression pipeline within the JetBrains Ktor framework.\nAffected versions include all JetBrains Ktor releases prior to 3.4.1.\nNo authentication or specific privileges are required to exploit this vulnerability, as long as the targeted WebSocket endpoint is publicly or network-accessible and has decompression enabled.\nThe attack vector is network-based, utilizing standard WebSocket protocols over TCP or TLS connections.\nDuring exploitation, an attacker crafts malicious payloads consisting of high-compression-ratio data streams, commonly known as a zip bomb or decompression bomb variant tailored for WebSocket framing.\nThe attack flow proceeds as follows: 1. The attacker establishes a standard WebSocket connection with the vulnerable JetBrains Ktor server. 2. The attacker transmits a crafted, maliciously compressed WebSocket frame. 3. The server's WebSocket decompression subsystem intercepts the frame and attempts to decompress the payload. 4. Due to inadequate size restrictions and resource controls, the decompression algorithm expands the payload into an disproportionately large memory footprint or consumes excessive CPU cycles. 5. This unbounded consumption exhausts system resources such as heap memory or thread pools, resulting in a denial of service for legitimate users.\nThe post-exploitation impact is limited to denial of service, as arbitrary code execution or unauthorized data access is not inherently facilitated by this specific memory and CPU exhaustion vector."
}