Cap'n Proto: Integer overflow in KJ-HTTP chunk size #499625
Description
- CVE-2026-32240
- Nixpkgs security tracker issue
- affected package maintainers: cc @lf-, @9999years, @RaitoBezarius, @Qyriad, @alois31
Description
Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.
Affected packages
capnproto(1.2.0@nixos-25.11, 1.2.0@nixos-unstable)
Additional comment
Upstream advisory: https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm