Skip to main content

Capnproto CVE-2026-32240

MEDIUM
Numeric Truncation Error (CWE-197)
2026-03-12 security-advisories@github.com
Information Disclosure Capnproto Red Hat Suse
6.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SUSE
MEDIUM
qualitative
Red Hat
4.8 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 22:55 vuln.today
CVE Published
Mar 12, 2026 - 20:16 nvd
MEDIUM 6.5

DescriptionGitHub Advisory

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

AnalysisAI

n Proto is a data interchange format and capability-based RPC system. versions up to 1.4.0 contains a vulnerability that allows attackers to HTTP request/response smuggling.

Technical ContextAI

affects n Proto is a data interchange format and capability-based RPC system.. Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

RemediationAI

Fixed in version 1.4.0..

More in Capnproto

View all
CVE-2023-48230 CRITICAL POC
9.8 Nov 21

Cap'n Proto is a data interchange format and capability-based RPC system. Rated critical severity (CVSS 9.8), this vulne
CVE-2015-2311 CRITICAL
9.8 Aug 09

Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a d
CVE-2015-2310 CRITICAL
9.1 Aug 09

Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to c
CVE-2017-7892 HIGH
7.5 Apr 17

Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. Rated high severity (CVSS
CVE-2015-2312 HIGH
7.5 Aug 09

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and

CVE-2015-2313 HIGH
7.5 Aug 09

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an ob
CVE-2026-32239 MEDIUM
6.5 Mar 12

n Proto is a data interchange format and capability-based RPC system. versions up to 1.4.0 is affected by integer overfl
CVE-2022-46149 MEDIUM
5.4 Nov 30

Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Rated medium severity (CVSS 5.4), this

Same weakness CWE-197 – Numeric Truncation Error

View all
CVE-2022-42475 CRITICAL POC
9.8
CVE-2025-6965 HIGH POC
7.2
CVE-2020-15202 CRITICAL POC
9.0
CVE-2024-43639 CRITICAL
9.8
CVE-2026-55142 MEDIUM
5.5
CVE-2024-49018 HIGH
8.8
CVE-2024-43519 HIGH
8.8
CVE-2024-30009 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-32240 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy