CVE-2024-49580 json
JetBrains Ktor information disclosure
published 2024-10-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2998 , GHSA-8qv4-773j-c979
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure
Patch / fix
- maven io.ktor:ktor-client-core-jvm 2.3.13
- JetBrains Ktor 2.3.13, 3.0.0
- github.com/ktorio/ktor@0665736 commit
- github.com/ktorio/ktor@d6c3a51 commit
- github.com/ktorio/ktor#4337 pull request
- github.com/ktorio/ktor#4368 pull request
- github.com/ktorio/ktor/releases/tag/2.3.13 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.ktor:ktor-client-core-jvm | <2.3.13 |
2.3.13 |
Affected products
- JetBrains Ktor
Classification
- Weakness
-
- CWE-524 Use of Cache Containing Sensitive Information
References
-
github.com
/ktorio/ktor/pull/4337
web
-
github.com
/ktorio/ktor/pull/4368
web
-
github.com
/ktorio/ktor/commit/0665736fc35c8ab5525241e975f36819b67f9d3e
web
-
github.com
/ktorio/ktor/commit/d6c3a51df169c163e8f0b9ce77bbe543c70116ac
web
-
jetbrains.com
/privacy-security/issues-fixed/
vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-49580
advisory
-
github.com
/ktorio/ktor
package
-
github.com
/ktorio/ktor/releases/tag/2.3.13
web
-
jetbrains.com
/privacy-security/issues-fixed
web
-
youtrack.jetbrains.com
/issue/KTOR-7483
web
Sources
- CVE List CVE-2024-49580
- GitHub Advisory GHSA-8qv4-773j-c979
- NVD CVE-2024-49580
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.