CVE-2026-32240
MEDIUMCap'n Proto <1.4.0 - HTTP Smuggling
Title source: llmDescription
Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.
Scores
CVSS v3
6.5
EPSS
0.0008
EPSS Percentile
24.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Details
CWE
CWE-444
CWE-197
Status
published
Products (1)
capnproto/capnproto
< 1.4.0
Published
Mar 12, 2026
Tracked Since
Mar 13, 2026