Skip to content
CVE IDCVE-2024-49580GitHub advisory IDGHSA-8qv4-773j-c979

JetBrains Ktor information disclosure

CVE-2024-49580 (GitHub advisory GHSA-8qv4-773j-c979) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.3, classed as Use of Cache Containing Sensitive Information (CWE-524), in io.ktor:ktor-client-core-jvm (Maven). Affected versions: < 2.3.13. It is fixed in 2.3.13.

Medium5.3Fix availableGitHub reviewed

Published 17 Oct 2024Updated 6 Dec 2024

5.3MediumCVSS 3.1
CVE ID
CVE-2024-49580
GHSA ID
GHSA-8qv4-773j-c979
EPSS
0.35%higher than 26% of CVEs
Weakness (CWE)
  • CWE-524Use of Cache Containing Sensitive Information
KEV status
Not in KEV
Published
17 Oct 2024
Updated
6 Dec 2024
Ecosystem
  • Maven
Assigned by (CNA)
JetBrains

Summary

Source: OSV (GitHub advisory)

Improper caching in JetBrains Ktor before 3.0.0 in the HttpCache Plugin could lead to response information disclosure.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Medium5.3Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
Low
Integrity I
None
Availability A
None

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
yes
Attackers can automate this at scale
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • io.ktor:ktor-client-core-jvm
    Maven
    pkg:maven/io.ktor/ktor-client-core-jvm
    Affected versions
    < 2.3.13
    Fixed in
    2.3.13
    Show 70 listed versions
    • 1.0.0
    • 1.0.0-rc
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.2.0
    • 1.2.0-rc
    • 1.2.0-rc2

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 2.3.13 or later.

Patch commits

  • 0665736Patch commitgithub.com/ktorio/ktor

    KTOR-7483 Allow auth header when client is not shared (#4368)

    +25 −47 across 4 files

    • ktor-client/ktor-client-core/api/ktor-client-core.api+1 −3
    • ktor-client/ktor-client-core/api/ktor-client-core.klib.api+0 −3
    • ktor-client/ktor-client-core/common/src/io/ktor/client/plugins/cache/HttpCache.kt+22 −35
    • ktor-client/ktor-client-core/jvm/test/HttpCacheTest.kt+2 −6
  • d6c3a51Patch commitgithub.com/ktorio/ktor

    KTOR-7483 Avoid caching requests with Authorization header (#4337)

    +153 −4 across 6 files

    • ktor-client/ktor-client-core/api/ktor-client-core.api+3 −1
    • ktor-client/ktor-client-core/api/ktor-client-core.klib.api+3 −0
    • ktor-client/ktor-client-core/build.gradle.kts+1 −0
    • ktor-client/ktor-client-core/common/src/io/ktor/client/plugins/cache/HttpCache.kt+19 −2
    • ktor-client/ktor-client-core/jvm/test/HttpCacheTest.kt+127 −0
    • ktor-io/common/test/ByteReadChannelOperationsTest.kt+0 −1
  • #4337Pull requestgithub.com/ktorio/ktor
  • #4368Pull requestgithub.com/ktorio/ktor

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 6d55f8bRelease commit3.0.0github.com/ktorio/ktor

Vulnerability intelligence

References

Credits

Questions about CVE-2024-49580

What is the GHSA ID for CVE-2024-49580?
GitHub tracks CVE-2024-49580 as GHSA-8qv4-773j-c979.
What is the CVSS score of CVE-2024-49580?
CVE-2024-49580 has a CVSS 3.1 base score of 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Which versions are affected by CVE-2024-49580?
io.ktor:ktor-client-core-jvm (Maven): < 2.3.13.
How do I fix CVE-2024-49580?
Upgrade to 2.3.13 or later. The fix is in commits 0665736 and d6c3a51 and pull requests #4337 and #4368.
What is the Package URL (PURL) for CVE-2024-49580?
The affected package's PURL is pkg:maven/io.ktor/ktor-client-core-jvm.
Is CVE-2024-49580 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-49580. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 4 days ago (9 Oct 2026, 19:41 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.