JetBrains’ Ktor framework before version 3.6.1 contains a flaw in its CIO engine that permits HTTP request smuggling. This weakness enables an attacker to craft an HTTP request that the server incorrectly parses as multiple requests, potentially leading to data tampering, unauthorized data flows, or denial of service. The flaw is classified as CWE-444.

The vulnerability affects JetBrains Ktor applications running any version prior to 3.6.1. Deployments using newer releases are not impacted.

With a CVSS score of 4.8 the risk is moderate. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is network‑based; an adversary must send a specially crafted HTTP request to an exposed Ktor service. While the vulnerability does not grant remote code execution, its exploitation can enable request manipulation across proxy or load‑balancer boundaries. Organizations should consider the potential for data breaches or service disruption and prioritize remediation accordingly.