Executive brief
JetBrains Ktor is a web framework used to build server and client applications in Kotlin. Versions before 3.4.1 contain a denial-of-service vulnerability in WebSocket message decompression that could allow an attacker to disrupt service availability by sending malicious compressed WebSocket messages.
Technical details
This vulnerability is a denial-of-service (DoS) flaw in Ktor's WebSocket decompression handling. The vulnerability exists in versions before 3.4.1 and can be exploited by sending specially crafted compressed WebSocket frames. An attacker with network access to a Ktor application using WebSocket functionality can trigger excessive resource consumption or application crashes. The attack requires no authentication or special preconditions beyond network reachability. The fix is available in Ktor 3.4.1 and later versions.
Affected products
- JetBrains Ktor before 3.4.1
Timeline
- 2026-08-17: disclosed
- 2026: patched: Fixed in Ktor 3.4.1