In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26129
Reference (s):
- https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
- https://blog.jetbrains.com