CVE-2026-32240 Cap'n Proto: Integer overflow in KJ-HTTP chunk size

Medium 6.3 Published 12 Mar 2026 Updated 13 Mar 2026

An integer overflow in Cap'n Proto's HTTP chunk parsing allows HTTP request/response smuggling by truncating large chunk sizes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-32240?

CVE-2026-32240 is a medium-severity vulnerability in capnproto, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

Weakness: CWE-444, CWE-197

Which versions are affected by CVE-2026-32240?

It affects 1 product.

Products include Capnproto Capnproto.

How do I fix CVE-2026-32240?

Upgrade to a fixed version.

Is CVE-2026-32240 being exploited?

There is no known exploitation of CVE-2026-32240 in the wild and no public exploit code.

Sources

Also known as AZL-79800, DEBIAN-CVE-2026-32240, GHSA-vpcq-mx5v-32wm, JLSEC-2026-1270, UBUNTU-CVE-2026-32240.