Summary
Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly
handled negative Content-Length values or excessively large chunk sizes
when processing HTTP messages. An attacker could possibly use these
issues to cause HTTP messages to be interpreted inconsistently,
resulting in HTTP request or response smuggling. (CVE-2026-32239,
CVE-2026-32240)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | capnproto | 0.6.1-1ubuntu1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | capnproto | 0.7.0-6ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | capnproto | 0.8.0-2ubuntu2+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | capnproto | 1.0.1-4ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | capnproto | 1.1.0-2.1ubuntu0.1~esm1 |
Vulnerabilities 2
-
Medium 6.3
Cap'n Proto has an integer overflow in KJ-HTTP
Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smug…
-
Medium 6.3
Cap'n Proto: Integer overflow in KJ-HTTP chunk size
Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable…