CVE-2026-32239
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Mar 12, 2026
CISA due date
—
The record
Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | capnproto | 0 | 1.4.0-160000.1.1 |
| openSUSE:Tumbleweed | capnproto | 0 | 1.4.0-2.1 |
Related vulnerabilities
- CVE-2026-32240 Cap'n Proto is a data interchange format and capability-based RPC system. Also affects capnproto
- CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before… CWE-190
- CVE-2026-53615 util-linux is a random collection of Linux utilities. CWE-190
- CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
- CVE-2026-106571 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
- CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add()… CWE-190
- CVE-2026-102621 A vulnerability was identified in Freedesktop Poppler up to 26.08.0. CWE-190
- CVE-2026-102620 A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. CWE-190