Description (CNA)
In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Ktor.io / Ktor | affected < 1.3.0 |
CWE
CWE-444
References
- https://github.com/ktorio/ktor/security/advisories/GHSA-xrr9-rh8p-433v
- https://github.com/ktorio/ktor/pull/1547
ADP enrichment
No English description supplied.