{"id":"CVE-2026-32239","aliases":["AZL-79803","DEBIAN-CVE-2026-32239","EUVD-2026-11687","GHSA-qjx3-pp3m-9jpm","JLSEC-2026-1269","MGASA-2026-0474","UBUNTU-CVE-2026-32239","USN-8650-1","openSUSE-SU-2026:10588-1","openSUSE-SU-2026:21062-1"],"status":"published","title":"Cap'n Proto has an integer overflow in KJ-HTTP","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00243,"percentile":0.15556,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-444"],"published":"2026-03-12T19:33:25Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:14","package":"capnproto","fixed_in":["1.4.0-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"capnproto","fixed_in":["0.6.1-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"capnproto","fixed_in":["0.7.0-6ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"capnproto","fixed_in":["0.8.0-2ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"capnproto","fixed_in":["1.0.1-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"capnproto","fixed_in":["1.4.0-3build1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"capnproto","fixed_in":["1.1.0-2.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"capnproto","fixed_in":["1.4.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.1-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-2","0.9.2-3","0.9.2-4","1.0.1-1","1.0.1-2","1.0.1-3","1.0.1-4","1.1.0-1","1.1.0-2","1.1.0-2.1","1.4.0-1","1.4.0-2","1.4.0-3","1.5.0-1","1.5.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2","1.1.0-2.1","1.4.0-1","1.4.0-2","1.4.0-3","1.5.0-1","1.5.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-2"}]}],"versions":["1.1.0-2","1.1.0-2.1","1.4.0-1"]},{"source":"osv","ecosystem":"Julia","package":"capnproto_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-1ubuntu1+esm1"}]}],"versions":["0.5.3-2ubuntu2","0.6.1-1","0.6.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-6ubuntu0.1~esm1"}]}],"versions":["0.7.0-5","0.7.0-5build1","0.7.0-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-2ubuntu2+esm1"}]}],"versions":["0.7.0-7build1","0.8.0-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-4ubuntu0.1~esm1"}]}],"versions":["0.9.2-3","1.0.1-2","1.0.1-3","1.0.1-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3build1"}]}],"versions":["1.1.0-2.1","1.4.0-2","1.4.0-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2.1ubuntu0.1~esm1"}]}],"versions":["1.1.0-2","1.1.0-2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-1ubuntu1+esm1"}]}],"versions":["0.5.3-2ubuntu2","0.6.1-1","0.6.1-1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-6ubuntu0.1~esm1"}]}],"versions":["0.7.0-5","0.7.0-5build1","0.7.0-6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-2ubuntu2+esm1"}]}],"versions":["0.7.0-7build1","0.8.0-2ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-4ubuntu0.1~esm1"}]}],"versions":["0.9.2-3","1.0.1-2","1.0.1-3","1.0.1-4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2.1ubuntu0.1~esm1"}]}],"versions":["1.1.0-2","1.1.0-2.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"capnproto","product":"capnproto"}],"references":[{"url":"https://github.com/capnproto/capnproto/security/advisories/GHSA-qjx3-pp3m-9jpm","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/capnproto/capnproto/commit/e929f0ba7901a6b8f4b5ba9a4db00af43288cbb0","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://capnproto.org/capnproto-c++-1.4.0.tar.gz","tags":["x_refsource_MISC","Product","web"]},{"url":"https://capnproto.org/capnproto-c++-win32-1.4.0.zip","tags":["x_refsource_MISC","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32239","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32239.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-32239","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0474.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36190","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8650-1","tags":["advisory"]},{"url":"https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-32239","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32240","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32239","tags":["web"]},{"url":"https://bugzilla.suse.com/1259638","tags":["report"]},{"url":"https://bugzilla.suse.com/1259639","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32240","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-32239","title":"Cap'n Proto has an integer overflow in KJ-HTTP","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T19:33:25.052Z","modified":"2026-03-13T16:15:03.051Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-444","CWE-190"],"updated_at":"2026-11-02T14:19:57.47301Z"}],"euvd":[{"id":"EUVD-2026-11687","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T19:33:25Z","modified":"2026-03-13T16:15:03Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:35.389351Z"}],"nvd":[{"id":"CVE-2026-32239","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T20:16:05.01Z","modified":"2026-06-17T10:35:24.37Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-190","CWE-444"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"CVE-2026-32239","title":"Cap'n Proto has an integer overflow in KJ-HTTP","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T19:33:25.052Z","modified":"2026-10-28T02:30:38.520862403Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-190","CWE-444"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"DEBIAN-CVE-2026-32239","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T20:16:05.01Z","modified":"2026-10-01T03:03:10.41611099Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"JLSEC-2026-1269","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-08-12T19:53:38.652Z","modified":"2026-08-12T20:00:03.47756963Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"UBUNTU-CVE-2026-32239","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T20:16:00Z","modified":"2026-10-17T12:58:09.252696981Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-79803","title":"CVE-2026-32239 affecting package capnproto 1.0.1-4","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T20:16:05Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"MGASA-2026-0474","title":"Updated capnproto package fixes security vulnerabilities","description":"A negative Content-Length value was converted to unsigned, treating it\nas an impossibly large length instead (CVE-2026-32239).\nWhen using Transfer-Encoding: chunked, if a chunk's size parsed to a\nvalue of 2^64 or larger, it would be truncated to a 64-bit integer\n(CVE-2026-32240).\n","status":"published","published":"2026-10-09T17:00:24Z","modified":"2026-10-09T17:15:03.305201403Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10588-1","title":"capnproto-1.4.0-2.1 on GA media","description":"These are all security issues fixed in the capnproto-1.4.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-21T00:00:00Z","modified":"2026-04-22T08:17:20.790456Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21062-1","title":"Security update for capnproto","description":"This update for capnproto fixes the following issues:\n\nUpdate to version 1.4.0.\n\nSecurity issues fixed:\n\n- CVE-2026-32239: negative `Content-Length` conversion treated as impossibly large length by KJ-HTTP can lead to HTTP\n  smuggling (bsc#1259638).\n- CVE-2026-32240: integer overflow when KJ-HTTP `Transfer-Encoding` chunk size is parsed to a value of 2^64 or larger\n  can lead to HTTP smuggling (bsc#1259639).\n\nOther updates and bugfixes:\n\n- Have `stdcoro` use `::std` namespace.\n- Disable stack check when HWASan is used.\n- Fix benign buffer overrun in async `readMessage()`.\n- Shared library naming changes from `libsomething-%{version}.so` to `libsomething.so.%{version}`.\n","status":"published","published":"2026-06-26T07:23:30Z","modified":"2026-06-30T18:24:38.458230868Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"USN-8650-1","title":"capnproto vulnerabilities","description":"Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly\nhandled negative Content-Length values or excessively large chunk sizes\nwhen processing HTTP messages. An attacker could possibly use these\nissues to cause HTTP messages to be interpreted inconsistently,\nresulting in HTTP request or response smuggling. (CVE-2026-32239,\nCVE-2026-32240)","status":"published","published":"2026-08-19T16:00:14Z","modified":"2026-08-20T00:14:23.573921998Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}