JetBrains Ktor versions prior to 3.4.1 allow an attacker to trigger a denial‑of‑service condition by sending specially crafted WebSocket frames that exploit a flawed decompression routine. The flaw is rooted in loop‑count control issues described by CWE‑835, allowing excessively large decompression loops to consume system resources and degrade performance. Once triggered, the application can become unresponsive and may refuse legitimate traffic, compromising availability for all users of the affected service.

The vulnerability affects the Ktor web framework distributed by JetBrains. Any installation using Ktor before version 3.4.1, whether part of a microservice application, an API gateway, or a standalone server, is potentially exposed. The impact spans all systems that expose WebSocket endpoints without guarding against decompression overload.

The CVSS score of 5.9 places the issue in the moderate range, indicating that while the vulnerability is not immediately catastrophic, it could still be abused. EPSS data is currently unavailable and the flaw is not listed in CISA's KEV catalog, which suggests limited proven exploitation at this time. However, the likely attack vector is remote: an external attacker can connect to any exposed WebSocket endpoint and send the malicious payload. The attacker requires network reachability to the target but does not need elevated privileges or authentication, making it a relatively simple exploit.