CVE-2020-5207: Open Source Vulnerability in io.ktor:ktor-client-cio and io.ktor:ktor-server-cio
Summary
CVE-2020-5207: Request smuggling is possible when both chunked TE and content length specified. Affects io.ktor:ktor-client-cio versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.ktor:ktor-client-cio and io.ktor:ktor-server-cio packages are part of the Ktor framework, which is a Kotlin-based asynchronous web framework for building web applications and services. These packages provide client and server functionality using the CIO (Coroutine I/O) engine. The vulnerability affects versions prior to 1.3.0 of both packages.
Vulnerability Detail
The vulnerability, identified as CVE-2020-5207, allows for request smuggling when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding headers properly or doesn't handle alone \n as a headers separator. This can lead to request smuggling attacks, where an attacker can manipulate the HTTP requests to bypass security measures or perform unauthorized actions. The impact of this vulnerability is dependent on the proxy configuration and the specific application using the affected packages.
How To Fix
Latest published version: 3.6.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability, except migrating to a better proxy that handles Content-Length and Transfer-Encoding headers properly.
Conclusion
In conclusion, the io.ktor:ktor-client-cio and io.ktor:ktor-server-cio packages prior to version 1.3.0 are vulnerable to request smuggling attacks. To mitigate this vulnerability, it is crucial to update the packages to version 1.3.0 or later. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for io.ktor:ktor-client-cio →
FAQ
The impact of this vulnerability depends on the proxy configuration and the specific application using the affected packages. It can potentially allow for request smuggling attacks, bypassing security measures or performing unauthorized actions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to promptly update the affected packages to mitigate the risk.
The recommended approach is to update the packages to the fixed version. However, if updating is not immediately feasible, you can consider implementing additional security measures such as a WAF (Web Application Firewall) that can detect and block request smuggling attempts.
Yes, you can refer to the PortSwigger Web Security Academy (https://portswigger.net/web-security/request-smuggling) and RFC 7230 (https://tools.ietf.org/html/rfc7230#section-9.5) for more information about request smuggling attacks and related concepts.
