CVE-2026-32240

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32240
Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://capnproto.org/capnproto-c++-1.4.0.tar.gz Product
https://capnproto.org/capnproto-c++-win32-1.4.0.zip Product
https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36 Patch
https://github.com/capnproto/capnproto/commit/e929f0ba7901a6b8f4b5ba9a4db00af43288cbb0 Patch
https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:capnproto:capnproto:*:*:*:*:*:*:*:*
History

18 Mar 2026, 17:01

Type Values Removed Values Added
Summary
  • (es) Cap'n Proto es un formato de intercambio de datos y un sistema RPC basado en capacidades. Antes de la versión 1.4.0, al usar Transfer-Encoding: chunked, si el tamaño de un fragmento se analizaba a un valor de 2^64 o superior, se truncaba a un entero de 64 bits. En teoría, este error podría permitir el contrabando de solicitudes/respuestas HTTP. Esta vulnerabilidad está corregida en la versión 1.4.0.
First Time Capnproto
Capnproto capnproto
CPE cpe:2.3:a:capnproto:capnproto:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
References () https://capnproto.org/capnproto-c++-1.4.0.tar.gz - () https://capnproto.org/capnproto-c++-1.4.0.tar.gz - Product
References () https://capnproto.org/capnproto-c++-win32-1.4.0.zip - () https://capnproto.org/capnproto-c++-win32-1.4.0.zip - Product
References () https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36 - () https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36 - Patch
References () https://github.com/capnproto/capnproto/commit/e929f0ba7901a6b8f4b5ba9a4db00af43288cbb0 - () https://github.com/capnproto/capnproto/commit/e929f0ba7901a6b8f4b5ba9a4db00af43288cbb0 - Patch
References () https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm - () https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm - Vendor Advisory

12 Mar 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-12 20:16

Updated : 2026-03-18 17:01

NVD link : CVE-2026-32240

Mitre link : CVE-2026-32240

CVE.ORG link : CVE-2026-32240

JSON object : View

Products Affected

capnproto

  • capnproto
CWE
CWE-197

Numeric Truncation Error

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')