Skip to content
CVE IDCVE-2023-34339GitHub advisory IDGHSA-w2c4-vpgj-g3jp

In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the excep...

CVE-2023-34339 (GitHub advisory GHSA-w2c4-vpgj-g3jp) is a low-severity vulnerability with a CVSS 3.1 base score of 3.3, classed as Generation of Error Message Containing Sensitive Information (CWE-209), in github.com/ktorio/ktor (Git repository). Affected versions: < 2.3.1. It is fixed in 2.3.1.

Low3.3Fix availableUnreviewed advisory

Published 1 Jun 2023Updated 8 Jan 2025

3.3LowCVSS 3.1
CVE ID
CVE-2023-34339
GHSA ID
GHSA-w2c4-vpgj-g3jp
EPSS
0.21%higher than 9% of CVEs
Weakness (CWE)
  • CWE-209Generation of Error Message Containing Sensitive Information
KEV status
Not in KEV
Published
1 Jun 2023
Updated
8 Jan 2025
Ecosystem
  • Git repositories
Assigned by (CNA)
JetBrains

Summary

Source: GitHub Advisory Database

In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Low3.3Base score from GitHub Advisory Database

Attack Vector AV
Local
Attack Complexity AC
Low
Privileges Required PR
Low
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
Low
Integrity I
None
Availability A
None

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
no
Needs manual steps per target
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (CVE record)

  • https://github.com/ktorio/ktor
    Git repositories
    pkg:github/ktorio/ktor
    Affected versions
    < 2.3.1
    Fixed in
    2.3.1
    Show 84 listed versions
    • 2.3.0
    • 2.2.4
    • 2.2.3
    • 2.2.2
    • 2.2.1
    • 2.2.0
    • 2.1.3
    • 2.1.2
    • 2.1.1
    • 2.1.0
    • 2.0.3
    • 2.0.2

Fix

Source: OSV (CVE record)

Fix available

Upgrade to 2.3.1 or later.

Vulnerability intelligence

References

Questions about CVE-2023-34339

What is the GHSA ID for CVE-2023-34339?
GitHub tracks CVE-2023-34339 as GHSA-w2c4-vpgj-g3jp.
What is the CVSS score of CVE-2023-34339?
CVE-2023-34339 has a CVSS 3.1 base score of 3.3 (Low), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Which versions are affected by CVE-2023-34339?
https://github.com/ktorio/ktor (GIT): < 2.3.1.
How do I fix CVE-2023-34339?
Upgrade to 2.3.1 or later.
What is the Package URL (PURL) for CVE-2023-34339?
The affected package's PURL is pkg:github/ktorio/ktor.
Is CVE-2023-34339 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2023-34339. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 9% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)No record
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 14:00 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
GitHub Advisory Database
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (CVE record)
Fix
OSV (CVE record)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.