CVE-2026-32240

NameCVE-2026-32240
DescriptionCap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
capnproto (PTS)bullseye0.7.0-7vulnerable
bookworm0.9.2-2vulnerable
trixie1.1.0-2vulnerable
forky, sid1.1.0-2.1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
capnprotosource(unstable)(unfixed)

Notes

https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm
Fixed by: https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36 (v1.4.0)

Search for package or bug name: Reporting problems