PT-2026-25069

CVE-2026-32240

Published

2026-03-12

Updated

2026-08-19

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cap'n Proto versions prior to 1.4.0

Description Cap'n Proto is a data interchange format and capability-based RPC system. Prior to version 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size was parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. This could potentially enable HTTP request/response smuggling. The issue is related to the parsing of chunk sizes in HTTP requests when the Transfer-Encoding is set to chunked.

Recommendations Versions prior to 1.4.0 should be updated to version 1.4.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-197: Numeric Truncation Error

CWE-444: Inconsistent Interpretation of HTTP Requests (\'HTTP Request/Response Smuggling\')

Related identifiers