| Package | Affected versions | Patched versions |
|---|---|---|
| io.ktor:ktor-client-cio | < 1.3.0 | 1.3.0 |
| io.ktor:ktor-server-cio | < 1.3.0 | 1.3.0 |
| ktor | < 1.3.0 | 1.3.0 |
Request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle alone \n as a headers separator.
https://github.com/ktorio/ktor/pull/1547
None except migrating to a better proxy.
https://portswigger.net/web-security/request-smuggling https://tools.ietf.org/html/rfc7230#section-9.5
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free