CVE Feed

    Dashboard / CVE / CVE-2020-5207

    CVE-2020-5207

    In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.

    Published:Jan 27, 2020
    Last Modified:Nov 21, 2024
    EPS:Jan 27, 2020
    EPSS Score:0.00004
    CVSS Score:5.4

    Affected Products

    Vendor
    Jetbrains
    Product
    Ktor

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-273 HTTP Response Smuggling
    CAPEC-33 HTTP Request Smuggling

    Related CVEs

    CVE-2026-68762 (CVSS 5.9) — In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible…
    CVE-2025-29904 (CVSS 5.3) — In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible…
    CVE-2024-49580 (CVSS 5.3) — In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclo…
    CVE-2023-45613 (CVSS 6.8) — In JetBrains Ktor before 2.3.5 server certificates were not verified…
    CVE-2023-45612 (CVSS 8.6) — In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to X…
    CVE-2023-34339 (CVSS 3.3) — In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's messag…
    CVE-2022-48476 (CVSS 7.5) — In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible …
    CVE-2022-38180 (CVSS 5.3) — In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases…
    CVE-2022-38179 (CVSS 4.7) — JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack…
    CVE-2022-29930 (CVSS 8.7) — SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor v…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High