CVE-2024-49580 JetBrains Ktor information disclosure

What is CVE-2024-49580?

CVE-2024-49580 is a medium-severity vulnerability in JetBrains Ktor, published on 17 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure

Weakness: CWE-524

Which versions are affected by CVE-2024-49580?

2 open source packages ship an affected version, including io.ktor:ktor-client-core-jvm. It affects 1 product.

Products include Jetbrains Ktor.

How do I fix CVE-2024-49580?

Upgrade io.ktor:ktor-client-core-jvm to 2.3.13 or later.

Is CVE-2024-49580 being exploited?

There is no known exploitation of CVE-2024-49580 in the wild and no public exploit code.

Other vulnerabilities in JetBrains Ktor

• CVE-2019-12736 Command injection in n/a Critical 9.8
• CVE-2022-29930 SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. High 8.7
• CVE-2023-45612 XML external entity in Ktor High 8.6
• CVE-2022-48476 Path traversal in Ktor High 7.5
• CVE-2021-43203 Auth bypass in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8qv4-773j-c979.