Jetbrains · Ktor · CVE-2020-5207
**Name of the Vulnerable Software and Affected Versions**
Ktor versions prior to 1.3.0
**Description**
The issue allows for request smuggling when Ktor is run behind a proxy that does not properly handle Content-Length and Transfer-Encoding, or does not handle `
` as a headers separator. This can occur when the proxy does not correctly process requests with specific headers, potentially leading to security issues.
**Recommendations**
For versions prior to 1.3.0, migrate to a version that is 1.3.0 or later to resolve the issue. As a temporary workaround, consider using a better proxy that correctly handles Content-Length, Transfer-Encoding, and `
` as a headers separator to minimize the risk of exploitation.