Capnproto vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Capnproto products: 2 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-32240 Medium · 6.5 CWE-197 Mar 12, 2026

Cap'n Proto: Integer overflow in KJ-HTTP chunk size

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

CVE-2026-32239 Medium · 6.5 CWE-190 Mar 12, 2026

Cap'n Proto has an integer overflow in KJ-HTTP

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.