CVE-2026-32239
Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values or excessively large chunk sizes when processing HTTP messages. An attacker could possibly use these issues to cause HTTP messages to be interpreted inconsistently, resulting in HTTP request or response smuggling. (CVE-2026-32239, CVE-2026-32240)
CSIRTS triage
- What
- Incorrect handling of negative Content-Length values and excessively large chunk sizes in HTTP message processing enables HTTP request or response smuggling.
- Who is affected
- Systems using Cap'n Proto for HTTP message processing are affected.
- Urgency
- Moderate urgency; HTTP smuggling can lead to request confusion and cache poisoning but requires specific conditions.
- Action
- Update Cap'n Proto to a patched version addressing CVE-2026-32239 and CVE-2026-32240.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-32239
Get an email if CVE-2026-32239 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.
Advisory coverage (1)
- unknownUSN-8650-1: Cap'n Proto vulnerabilitiesubuntu · 2026-08-19
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-32239)