CVE-2026-32239

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

A negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead (CVE-2026-32239). When using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer (CVE-2026-32240).

These are all security issues fixed in the capnproto-1.4.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for capnproto fixes the following issues:

Update to version 1.4.0.

Security issues fixed:

• CVE-2026-32239: negative Content-Length conversion treated as impossibly large length by KJ-HTTP can lead to HTTP smuggling (bsc#1259638).
• CVE-2026-32240: integer overflow when KJ-HTTP Transfer-Encoding chunk size is parsed to a value of 2^64 or larger can lead to HTTP smuggling (bsc#1259639).

Other updates and bugfixes:

• Have stdcoro use ::std namespace.
• Disable stack check when HWASan is used.
• Fix benign buffer overrun in async readMessage().
• Shared library naming changes from libsomething-%{version}.so to libsomething.so.%{version}.

Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values or excessively large chunk sizes when processing HTTP messages. An attacker could possibly use these issues to cause HTTP messages to be interpreted inconsistently, resulting in HTTP request or response smuggling. (CVE-2026-32239, CVE-2026-32240)