CVE-2026-32239 Cap'n Proto has an integer overflow in KJ-HTTP
An integer overflow in Cap'n Proto's KJ-HTTP allows negative Content-Length values to be misinterpreted, potentially enabling HTTP request smuggling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32239?
CVE-2026-32239 is a medium-severity vulnerability in capnproto, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.
Which versions are affected by CVE-2026-32239?
It affects 1 product.
Linux distribution packages (1)
capnproto openSUSE:Tumbleweed | All versions | 1.4.0-2.1 |
Products include Capnproto Capnproto.
How do I fix CVE-2026-32239?
Upgrade to a fixed version.
Is CVE-2026-32239 being exploited?
There is no known exploitation of CVE-2026-32239 in the wild and no public exploit code.
Other vulnerabilities in capnproto
Sources
Also known as AZL-79803, DEBIAN-CVE-2026-32239, GHSA-qjx3-pp3m-9jpm, JLSEC-2026-1269, UBUNTU-CVE-2026-32239, openSUSE-SU-2026:10588-1.