CVE-2026-32239

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32239
Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://capnproto.org/capnproto-c++-1.4.0.tar.gz Product
https://capnproto.org/capnproto-c++-win32-1.4.0.zip Product
https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36 Patch
https://github.com/capnproto/capnproto/commit/e929f0ba7901a6b8f4b5ba9a4db00af43288cbb0 Patch
https://github.com/capnproto/capnproto/security/advisories/GHSA-qjx3-pp3m-9jpm Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:capnproto:capnproto:*:*:*:*:*:*:*:*
History

18 Mar 2026, 16:55

Type Values Removed Values Added
Summary
  • (es) Cap'n Proto es un formato de intercambio de datos y un sistema RPC basado en capacidades. Antes de la versión 1.4.0, un valor negativo de Content-Length se convertía a sin signo, tratándolo en su lugar como una longitud imposiblemente grande. En teoría, este error podría permitir el contrabando de solicitudes/respuestas HTTP. Esta vulnerabilidad está corregida en la versión 1.4.0.
CPE cpe:2.3:a:capnproto:capnproto:*:*:*:*:*:*:*:*
References () https://capnproto.org/capnproto-c++-1.4.0.tar.gz - () https://capnproto.org/capnproto-c++-1.4.0.tar.gz - Product
References () https://capnproto.org/capnproto-c++-win32-1.4.0.zip - () https://capnproto.org/capnproto-c++-win32-1.4.0.zip - Product
References () https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36 - () https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36 - Patch
References () https://github.com/capnproto/capnproto/commit/e929f0ba7901a6b8f4b5ba9a4db00af43288cbb0 - () https://github.com/capnproto/capnproto/commit/e929f0ba7901a6b8f4b5ba9a4db00af43288cbb0 - Patch
References () https://github.com/capnproto/capnproto/security/advisories/GHSA-qjx3-pp3m-9jpm - () https://github.com/capnproto/capnproto/security/advisories/GHSA-qjx3-pp3m-9jpm - Vendor Advisory
First Time Capnproto
Capnproto capnproto
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

12 Mar 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-12 20:16

Updated : 2026-03-18 16:55

NVD link : CVE-2026-32239

Mitre link : CVE-2026-32239

CVE.ORG link : CVE-2026-32239

JSON object : View

Products Affected

capnproto

  • capnproto
CWE
CWE-190

Integer Overflow or Wraparound

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')