{"id":"CVE-2026-32240","aliases":["AZL-79800","DEBIAN-CVE-2026-32240","EUVD-2026-11688","GHSA-vpcq-mx5v-32wm","JLSEC-2026-1270","MGASA-2026-0474","UBUNTU-CVE-2026-32240","USN-8650-1","openSUSE-SU-2026:21062-1"],"status":"published","title":"Cap'n Proto: Integer overflow in KJ-HTTP chunk size","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00243,"percentile":0.15556,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-197","CWE-444"],"published":"2026-03-12T19:35:57Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:14","package":"capnproto","fixed_in":["1.4.0-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"capnproto","fixed_in":["0.6.1-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"capnproto","fixed_in":["0.7.0-6ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"capnproto","fixed_in":["0.8.0-2ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"capnproto","fixed_in":["1.0.1-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"capnproto","fixed_in":["1.4.0-3build1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"capnproto","fixed_in":["1.1.0-2.1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.1-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-2","0.9.2-3","0.9.2-4","1.0.1-1","1.0.1-2","1.0.1-3","1.0.1-4","1.1.0-1","1.1.0-2","1.1.0-2.1","1.4.0-1","1.4.0-2","1.4.0-3","1.5.0-1","1.5.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2","1.1.0-2.1","1.4.0-1","1.4.0-2","1.4.0-3","1.5.0-1","1.5.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-2"}]}],"versions":["1.1.0-2","1.1.0-2.1","1.4.0-1"]},{"source":"osv","ecosystem":"Julia","package":"capnproto_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-1ubuntu1+esm1"}]}],"versions":["0.5.3-2ubuntu2","0.6.1-1","0.6.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-6ubuntu0.1~esm1"}]}],"versions":["0.7.0-5","0.7.0-5build1","0.7.0-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-2ubuntu2+esm1"}]}],"versions":["0.7.0-7build1","0.8.0-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-4ubuntu0.1~esm1"}]}],"versions":["0.9.2-3","1.0.1-2","1.0.1-3","1.0.1-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3build1"}]}],"versions":["1.1.0-2.1","1.4.0-2","1.4.0-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2.1ubuntu0.1~esm1"}]}],"versions":["1.1.0-2","1.1.0-2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-1ubuntu1+esm1"}]}],"versions":["0.5.3-2ubuntu2","0.6.1-1","0.6.1-1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-6ubuntu0.1~esm1"}]}],"versions":["0.7.0-5","0.7.0-5build1","0.7.0-6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-2ubuntu2+esm1"}]}],"versions":["0.7.0-7build1","0.8.0-2ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-4ubuntu0.1~esm1"}]}],"versions":["0.9.2-3","1.0.1-2","1.0.1-3","1.0.1-4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2.1ubuntu0.1~esm1"}]}],"versions":["1.1.0-2","1.1.0-2.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"capnproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"capnproto","product":"capnproto"}],"references":[{"url":"https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/capnproto/capnproto/commit/e929f0ba7901a6b8f4b5ba9a4db00af43288cbb0","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://capnproto.org/capnproto-c++-1.4.0.tar.gz","tags":["x_refsource_MISC","Product","web"]},{"url":"https://capnproto.org/capnproto-c++-win32-1.4.0.zip","tags":["x_refsource_MISC","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32240","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32240.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-32240","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0474.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36190","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8650-1","tags":["advisory"]},{"url":"https://github.com/capnproto/capnproto/security/advisories/GHSA-qjx3-pp3m-9jpm","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-32240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32239","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259638","tags":["report"]},{"url":"https://bugzilla.suse.com/1259639","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32240","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-32240","title":"Cap'n Proto: Integer overflow in KJ-HTTP chunk size","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T19:35:57.374Z","modified":"2026-03-13T16:14:32.323Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-197","CWE-444"],"updated_at":"2026-11-02T14:19:57.47301Z"}],"euvd":[{"id":"EUVD-2026-11688","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T19:35:57Z","modified":"2026-03-13T16:14:32Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:35.389351Z"}],"nvd":[{"id":"CVE-2026-32240","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T20:16:05.19Z","modified":"2026-06-17T10:35:24.51Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-197","CWE-444"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"CVE-2026-32240","title":"Cap'n Proto: Integer overflow in KJ-HTTP chunk size","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T19:35:57.374Z","modified":"2026-10-28T02:31:06.379091795Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-197","CWE-444"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"DEBIAN-CVE-2026-32240","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T20:16:05.19Z","modified":"2026-10-01T03:03:10.669693269Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"JLSEC-2026-1270","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-08-12T19:53:38.652Z","modified":"2026-08-12T20:00:03.475496549Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"UBUNTU-CVE-2026-32240","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T20:16:00Z","modified":"2026-10-17T12:54:42.072265526Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-79800","title":"CVE-2026-32240 affecting package capnproto 1.0.1-4","description":"Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.","status":"published","published":"2026-03-12T20:16:05Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"MGASA-2026-0474","title":"Updated capnproto package fixes security vulnerabilities","description":"A negative Content-Length value was converted to unsigned, treating it\nas an impossibly large length instead (CVE-2026-32239).\nWhen using Transfer-Encoding: chunked, if a chunk's size parsed to a\nvalue of 2^64 or larger, it would be truncated to a 64-bit integer\n(CVE-2026-32240).\n","status":"published","published":"2026-10-09T17:00:24Z","modified":"2026-10-09T17:15:03.305201403Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21062-1","title":"Security update for capnproto","description":"This update for capnproto fixes the following issues:\n\nUpdate to version 1.4.0.\n\nSecurity issues fixed:\n\n- CVE-2026-32239: negative `Content-Length` conversion treated as impossibly large length by KJ-HTTP can lead to HTTP\n  smuggling (bsc#1259638).\n- CVE-2026-32240: integer overflow when KJ-HTTP `Transfer-Encoding` chunk size is parsed to a value of 2^64 or larger\n  can lead to HTTP smuggling (bsc#1259639).\n\nOther updates and bugfixes:\n\n- Have `stdcoro` use `::std` namespace.\n- Disable stack check when HWASan is used.\n- Fix benign buffer overrun in async `readMessage()`.\n- Shared library naming changes from `libsomething-%{version}.so` to `libsomething.so.%{version}`.\n","status":"published","published":"2026-06-26T07:23:30Z","modified":"2026-06-30T18:24:38.458230868Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"USN-8650-1","title":"capnproto vulnerabilities","description":"Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly\nhandled negative Content-Length values or excessively large chunk sizes\nwhen processing HTTP messages. An attacker could possibly use these\nissues to cause HTTP messages to be interpreted inconsistently,\nresulting in HTTP request or response smuggling. (CVE-2026-32239,\nCVE-2026-32240)","status":"published","published":"2026-08-19T16:00:14Z","modified":"2026-08-20T00:14:23.573921998Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}