CVE-2025-29904: JetBrains Ktor HTTP Request Smuggling

CVE-2025-29904 Overview

CVE-2025-29904 is an HTTP Request Smuggling vulnerability affecting JetBrains Ktor before version 3.1.1. Ktor is a Kotlin framework for building asynchronous servers and clients in connected systems. The flaw allows attackers to craft ambiguous HTTP requests that downstream servers and proxies interpret differently, enabling request desynchronization attacks. This weakness is categorized under CWE-444: Inconsistent Interpretation of HTTP Requests.

Critical Impact
Attackers can smuggle malicious HTTP requests through Ktor-based servers, potentially bypassing security controls, poisoning caches, or hijacking user sessions in front-end/back-end proxy configurations.

Affected Products

JetBrains Ktor versions prior to 3.1.1
Kotlin server-side applications built on the Ktor framework
Deployments where Ktor sits behind or in front of reverse proxies or load balancers

Discovery Timeline

2025-03-12 - CVE-2025-29904 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29904

Vulnerability Analysis

HTTP Request Smuggling (HRS) exploits discrepancies in how front-end and back-end servers parse the boundaries between HTTP requests. When Ktor and an intermediary proxy disagree on where one request ends and the next begins, an attacker can prepend a hidden request to a legitimate one. This desynchronization allows the smuggled request to be processed with different context than intended.

In deployments impacted by CVE-2025-29904, malformed or conflicting Content-Length and Transfer-Encoding headers, or improper handling of chunked encoding, cause Ktor to interpret request boundaries inconsistently with upstream proxies. Consequences include bypassing web application firewall rules, hijacking authenticated sessions, poisoning shared caches, and gaining unauthorized access to internal endpoints.

Root Cause

The root cause is inconsistent HTTP request parsing within Ktor's request handling pipeline before version 3.1.1. The framework did not strictly validate or normalize header combinations that convey message length, allowing crafted requests to be interpreted differently by Ktor than by fronting infrastructure. This falls under CWE-444.

Attack Vector

Exploitation requires no authentication and can be performed remotely over the network. An attacker sends a specially crafted HTTP request containing conflicting length indicators to a proxy that forwards traffic to a Ktor server. The proxy processes the request using one interpretation while Ktor processes it using another, leaving smuggled bytes queued for the next connection. Technical details are available in the JetBrains Security Issues Fixed advisory.

Detection Methods for CVE-2025-29904

Indicators of Compromise

HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers reaching Ktor endpoints
Unexpected requests appearing in Ktor access logs that do not correlate with proxy access logs
Anomalous session behavior where responses are delivered to unrelated clients on the same connection
Requests with malformed chunked encoding, oversized headers, or unusual whitespace around header delimiters

Detection Strategies

Compare front-end proxy access logs against Ktor application logs to identify request count or ordering mismatches
Deploy web application firewall rules that reject requests with ambiguous or duplicate length headers
Enable strict HTTP parsing on intermediary proxies and reject non-compliant requests before they reach Ktor

Monitoring Recommendations

Alert on HTTP 400 spikes and connection resets from Ktor services following proxy header normalization changes
Monitor for Transfer-Encoding values other than chunked or duplicate Content-Length headers in ingress traffic
Track authentication anomalies such as sessions rebinding to unexpected user identifiers, which may indicate successful smuggling

How to Mitigate CVE-2025-29904

Immediate Actions Required

Upgrade JetBrains Ktor to version 3.1.1 or later across all production and development environments
Audit all reverse proxy, load balancer, and CDN configurations fronting Ktor for consistent HTTP parsing rules
Enforce HTTP/1.1 strict compliance on intermediaries and disable ambiguous message framing

Patch Information

JetBrains has resolved this vulnerability in Ktor 3.1.1. Details are documented in the JetBrains Security Issues Fixed advisory. Applications should update their Ktor dependency in Gradle or Maven build files and redeploy affected services.

Workarounds

Configure fronting proxies such as NGINX or HAProxy to normalize or reject requests containing both Content-Length and Transfer-Encoding headers
Terminate keep-alive connections between the proxy and Ktor to limit the blast radius of desynchronization
Restrict exposure of Ktor services directly to untrusted networks until the upgrade is complete

bash

# Gradle dependency upgrade example
# Update build.gradle.kts to use the patched Ktor version
dependencies {
    implementation("io.ktor:ktor-server-core:3.1.1")
    implementation("io.ktor:ktor-server-netty:3.1.1")
}