CVE-2026-32239 — Cap'n Proto has an integer overflow in KJ-HTTP

Affected: capnproto

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

USN-8650-1 — capnproto vulnerabilities

Affected: Ubuntu:Pro:18.04:LTS: capnproto, Ubuntu:Pro:20.04:LTS: capnproto, Ubuntu:Pro:22.04:LTS: capnproto, Ubuntu:Pro:24.04:LTS: capnproto, Ubuntu:Pro:26.04:LTS: capnproto

Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values or excessively large chunk sizes when processing HTTP messages. An attacker could possibly use these issues to cause HTTP messages to be interpreted inconsistently, resulting in HTTP request or response smuggling. (CVE-2026-32239, CVE-2026-32240)

Most recent entries from all

CVE-2026-32239 — Cap'n Proto has an integer overflow in KJ-HTTP

USN-8650-1 — capnproto vulnerabilities