In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.

In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible

In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message