In JetBrains Ktor prior to 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE
jetbrains ktor