CVE-2026-32240: Cap'n Proto HTTP Smuggling Vulnerability

CVE-2026-32240 Overview

CVE-2026-32240 is an integer truncation vulnerability in Cap'n Proto, a high-performance data interchange format and capability-based RPC system. When processing HTTP requests using Transfer-Encoding: chunked, the library fails to properly validate chunk sizes that exceed 2^64. These oversized values are truncated to 64-bit integers, potentially enabling HTTP request/response smuggling attacks. This vulnerability affects Cap'n Proto versions prior to 1.4.0.

Critical Impact
Attackers could exploit this integer truncation flaw to perform HTTP request smuggling, potentially bypassing security controls, poisoning web caches, or hijacking user sessions in environments using Cap'n Proto's HTTP implementation.

Affected Products

Cap'n Proto C++ library versions prior to 1.4.0
Applications using Cap'n Proto's HTTP implementation with chunked transfer encoding
Systems processing untrusted HTTP requests through Cap'n Proto RPC

Discovery Timeline

2026-03-12 - CVE-2026-32240 published to NVD
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-32240

Vulnerability Analysis

This vulnerability stems from improper handling of hexadecimal chunk size values in Cap'n Proto's HTTP chunked transfer encoding parser. The HTTP/1.1 protocol specifies that chunk sizes in chunked transfer encoding are represented as hexadecimal numbers. When parsing these values, the vulnerable code accumulates the numeric value by multiplying by 16 and adding each digit without bounds checking.

When a maliciously crafted chunk size value exceeds the maximum representable 64-bit unsigned integer (2^64 - 1), the value silently overflows and wraps around to a much smaller number. This truncation creates a discrepancy between what the Cap'n Proto server interprets as the chunk boundary versus what an upstream proxy or downstream server might interpret, enabling HTTP request smuggling scenarios.

The vulnerability is classified under CWE-197 (Numeric Truncation Error), which occurs when a primitive is cast to a smaller size primitive and data is lost in the conversion.

Root Cause

The root cause lies in the hexadecimal parsing logic within the c++/src/kj/compat/http.c++ file. The original implementation accumulated chunk size values without checking whether the multiplication by 16 would cause an integer overflow. Each iteration of the parsing loop multiplies the current value by 16 (left shift by 4 bits) and adds the new digit. Without validation, extremely large input values wrap around due to unsigned integer overflow behavior in C++.

Attack Vector

An attacker exploiting this vulnerability would craft HTTP requests with chunked transfer encoding containing extremely large hexadecimal chunk size values. The attack requires network access to a service using Cap'n Proto's HTTP implementation. When positioned behind a reverse proxy or load balancer, the differing interpretations of message boundaries between the proxy and Cap'n Proto could allow an attacker to inject malicious requests or intercept responses intended for other users.

text

// Security patch from c++/src/kj/compat/http.c++ - Fix HTTP body size integer overflow bugs
// Source: https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36
 
       uint64_t value = 0;
       for (char c: text) {
+        uint64_t digit;
         if ('0' <= c && c <= '9') {
-          value = value * 16 + (c - '0');
+          digit = c - '0';
         } else if ('a' <= c && c <= 'f') {
-          value = value * 16 + (c - 'a' + 10);
+          digit = c - 'a' + 10;
         } else if ('A' <= c && c <= 'F') {
-          value = value * 16 + (c - 'A' + 10);
+          digit = c - 'A' + 10;
         } else {
           KJ_FAIL_REQUIRE("invalid HTTP chunk size", text, text.asBytes()) { break; }
           return value;
         }
+        KJ_REQUIRE(value <= (uint64_t(kj::maxValue) >> 4),
+            "HTTP chunk size overflow", text, text.asBytes()) { break; }
+        value = value * 16 + digit;
       }
 
       return value;

The fix introduces bounds checking before each multiplication operation. By verifying that value <= (uint64_t(kj::maxValue) >> 4) before multiplying by 16, the patch ensures that overflow cannot occur.

Detection Methods for CVE-2026-32240

Indicators of Compromise

Unusual HTTP requests with abnormally large chunk size values in hexadecimal format
Error logs showing "HTTP chunk size overflow" messages (post-patch) or unexpected request parsing behavior (pre-patch)
Anomalous HTTP traffic patterns where request boundaries appear inconsistent between logging systems
Evidence of HTTP request smuggling attacks such as response queue poisoning or unauthorized session access

Detection Strategies

Deploy network intrusion detection rules to identify HTTP chunked requests with chunk size fields exceeding reasonable thresholds
Monitor application logs for parsing errors or unexpected behavior related to chunked transfer encoding
Implement Web Application Firewall (WAF) rules to inspect and validate chunk size values in chunked transfer encoding headers
Use traffic analysis tools to detect request smuggling patterns such as CL.TE or TE.CL desynchronization

Monitoring Recommendations

Enable verbose logging for Cap'n Proto HTTP services to capture detailed request parsing information
Set up alerts for abnormal chunk size values or parsing failures in HTTP traffic
Monitor for signs of cache poisoning or session hijacking that could indicate successful exploitation
Review access logs for requests that appear to bypass authentication or authorization controls

How to Mitigate CVE-2026-32240

Immediate Actions Required

Upgrade Cap'n Proto to version 1.4.0 or later immediately
Audit all applications and services using Cap'n Proto's HTTP implementation for exposure
Review network architecture to identify services accepting untrusted HTTP traffic through Cap'n Proto
Consider implementing additional request validation at the network perimeter while patching is in progress

Patch Information

The vulnerability is fixed in Cap'n Proto version 1.4.0. The fix adds explicit bounds checking before each multiplication operation in the chunk size parsing logic, preventing integer overflow conditions. Security patches are available through the following resources:

Cap'n Proto C++ Source Archive - Source code for Unix/Linux systems
Cap'n Proto C++ Win32 Archive - Precompiled binaries for Windows
GitHub Commit #2744b3c - Security patch commit
GitHub Commit #e929f0b - Additional security patch
GitHub Security Advisory GHSA-vpcq-mx5v-32wm - Official security advisory

Workarounds

Deploy a reverse proxy or WAF in front of vulnerable services to filter requests with abnormally large chunk sizes
Disable chunked transfer encoding at the network edge if operationally feasible
Implement strict request validation at load balancers to reject malformed HTTP requests before they reach Cap'n Proto services
Isolate services using Cap'n Proto from direct internet exposure until patching is complete

bash

# Verify Cap'n Proto version after upgrade
capnp --version
# Expected output: Cap'n Proto version 1.4.0 or higher

# Check for vulnerable installations in common locations
find /usr -name "libcapnp*" -exec ls -la {} \;
find /usr -name "libkj*" -exec ls -la {} \;