CVE-2019-11404

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-04-22 · updated 2026-06-17
Weakness: CWE-311

Description

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.

Affected products

Arrow-Kt Arrow: before 0.9.0 — fixed in 0.9.0

How to fix

Upgrade to a fixed version: Arrow-Kt Arrow 0.9.0. Check the vendor advisory for mitigations.

References

https://github.com/arrow-kt/ank/issues/35
https://github.com/arrow-kt/ank/pull/36
https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8
https://github.com/arrow-kt/arrow/issues/1310
https://github.com/arrow-kt/arrow/releases/tag/0.9.0
https://github.com/arrow-kt/ank/issues/35
https://github.com/arrow-kt/ank/pull/36
https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8
https://github.com/arrow-kt/arrow/issues/1310
https://github.com/arrow-kt/arrow/releases/tag/0.9.0

Get alerted when CVE-2019-11404 or the next vulnerability affects your stack