Kotlin
Monthly
Replay of captured Digest authentication credentials is possible in the http4k http4k-security-digest module (org.http4k:http4k-security-digest) because ServerFilters.DigestAuth and the underlying DigestAuthProvider default their nonceVerifier parameter to { true }, accepting every nonce regardless of value, age, or prior use. Any application that uses these components with the default configuration and exposes a protected resource has no replay protection: an attacker who obtains a valid 'Authorization: Digest' header - for example through network observation or reading logs that record the header - can replay that response indefinitely against the same resource, yielding credential-equivalent access and information disclosure rather than modification of data. The weakness has been present since DigestAuthProvider was introduced in 2021; the CVSS 4.0 score is 8.2 (8.2 with AT:P reflecting the capture prerequisite), and the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, treating it as a real but conditionally gated authentication weakness rather than a mass-exploitable critical. There is no public exploit identified at time of analysis, and vendor-released patches exist in 6.48.0.0, 5.42.0.0, and 4.51.0.0.
Cookie scoping bypass in the http4k client-side cookie jar (Maven org.http4k:http4k-core) causes cookies stored by BasicCookieStorage to be replayed to origins and schemes they were never scoped to, potentially exposing session cookies or other sensitive values. Only applications that reuse a single storage instance across more than one origin or scheme are affected; per-origin instances are explicitly unaffected, and no public exploit identified at time of analysis. The vendor rates this 8.3 (CVSS 4.0) while an independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting a conditional client-side confidentiality flaw that additionally requires an attacker-controlled or attacker-observable second destination before leaked cookies can be captured, making it moderate rather than high-urgency. Fixes ship in 6.48.0.0, 5.42.0.0, and 4.51.0.0; authentication is not required to trigger the flawed behavior (CVSS PR:N), but exploitation depends on the developer's multi-origin storage configuration rather than on attacker-supplied input reaching a server.
Remote code execution in JetBrains Kotlin before 2.4.20 stems from unsafe deserialization (CWE-502) of build cache metadata, allowing an attacker who can influence cached build artifacts to execute arbitrary code during a build. The flaw carries a CVSS 9.8 (C:H/I:H/A:H) rating, but there is no public exploit identified at time of analysis and EPSS is very low (0.11%, 2nd percentile), and CISA SSVC marks exploitation as 'none'. JetBrains, who reported the issue, has released a fixed version (2.4.20).
Unbounded buffering in the Server-Sent Events parser of the AG-UI Community SDK (Kotlin/Java) lets a malicious or man-in-the-middle-positioned agent endpoint drive a client-side memory exhaustion condition, degrading or killing the consuming process. All ag-ui-protocol ag-ui builds up to 2026-09-23 are flagged by CPE, specifically the Kotlin Community SDK SseParser.kt and its Java counterpart SseEventParser, which had no per-line or per-event size caps before the fix. Impact is availability-only (no confidentiality or integrity effect), an upstream fix exists as PR #2657 but was still awaiting acceptance, and no public exploit was identified at time of analysis.
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Replay of captured Digest authentication credentials is possible in the http4k http4k-security-digest module (org.http4k:http4k-security-digest) because ServerFilters.DigestAuth and the underlying DigestAuthProvider default their nonceVerifier parameter to { true }, accepting every nonce regardless of value, age, or prior use. Any application that uses these components with the default configuration and exposes a protected resource has no replay protection: an attacker who obtains a valid 'Authorization: Digest' header - for example through network observation or reading logs that record the header - can replay that response indefinitely against the same resource, yielding credential-equivalent access and information disclosure rather than modification of data. The weakness has been present since DigestAuthProvider was introduced in 2021; the CVSS 4.0 score is 8.2 (8.2 with AT:P reflecting the capture prerequisite), and the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, treating it as a real but conditionally gated authentication weakness rather than a mass-exploitable critical. There is no public exploit identified at time of analysis, and vendor-released patches exist in 6.48.0.0, 5.42.0.0, and 4.51.0.0.
Cookie scoping bypass in the http4k client-side cookie jar (Maven org.http4k:http4k-core) causes cookies stored by BasicCookieStorage to be replayed to origins and schemes they were never scoped to, potentially exposing session cookies or other sensitive values. Only applications that reuse a single storage instance across more than one origin or scheme are affected; per-origin instances are explicitly unaffected, and no public exploit identified at time of analysis. The vendor rates this 8.3 (CVSS 4.0) while an independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting a conditional client-side confidentiality flaw that additionally requires an attacker-controlled or attacker-observable second destination before leaked cookies can be captured, making it moderate rather than high-urgency. Fixes ship in 6.48.0.0, 5.42.0.0, and 4.51.0.0; authentication is not required to trigger the flawed behavior (CVSS PR:N), but exploitation depends on the developer's multi-origin storage configuration rather than on attacker-supplied input reaching a server.
Remote code execution in JetBrains Kotlin before 2.4.20 stems from unsafe deserialization (CWE-502) of build cache metadata, allowing an attacker who can influence cached build artifacts to execute arbitrary code during a build. The flaw carries a CVSS 9.8 (C:H/I:H/A:H) rating, but there is no public exploit identified at time of analysis and EPSS is very low (0.11%, 2nd percentile), and CISA SSVC marks exploitation as 'none'. JetBrains, who reported the issue, has released a fixed version (2.4.20).
Unbounded buffering in the Server-Sent Events parser of the AG-UI Community SDK (Kotlin/Java) lets a malicious or man-in-the-middle-positioned agent endpoint drive a client-side memory exhaustion condition, degrading or killing the consuming process. All ag-ui-protocol ag-ui builds up to 2026-09-23 are flagged by CPE, specifically the Kotlin Community SDK SseParser.kt and its Java counterpart SseEventParser, which had no per-line or per-event size caps before the fix. Impact is availability-only (no confidentiality or integrity effect), an upstream fix exists as PR #2657 but was still awaiting acceptance, and no public exploit was identified at time of analysis.
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.