CVE-2026-32239: 
NixOS vulnerability analysis and mitigation

CVE-2026-32239 is an integer overflow/type conversion vulnerability in the KJ-HTTP library (part of Cap'n Proto) that could theoretically enable HTTP request/response smuggling. The root cause is that a negative Content-Length header value is passed to strtoull(), which silently converts it to an impossibly large unsigned integer rather than rejecting it. All Cap'n Proto versions prior to 1.4.0 are affected; Cap'n Proto itself (without KJ-HTTP) is not impacted. The vulnerability was disclosed on March 12, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat).

The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound), CWE-681 (Incorrect Conversion Between Numeric Types), and CWE-444 (HTTP Request Smuggling). In c++/src/kj/compat/http.c++, the getEntityBody() function called strtoull() on the Content-Length header value without first validating that the string begins with a digit — strtoull() silently accepts a leading - sign and wraps the negative value to a very large uint64_t, causing the library to treat the body as having an impossibly large length. The fix adds an explicit check that the first character of the header value is a decimal digit ('0'–'9') before accepting the parsed result (GitHub Commit, GitHub Advisory). Exploitation requires a buggy upstream proxy that forwards the malformed negative Content-Length value unmodified to a KJ-HTTP-based server or client.

Successful exploitation could theoretically allow an attacker to perform HTTP request/response smuggling, potentially causing a KJ-HTTP-based server or client to misinterpret message boundaries. This could lead to low-level confidentiality and integrity impacts — for example, poisoning shared caches, bypassing security controls, or injecting malicious content into responses seen by other users. Availability is not directly impacted, and the scope is limited to systems using KJ-HTTP (notably workerd, the open-source Cloudflare Workers Runtime); Cloudflare's production Workers environment was confirmed unaffected (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.045% (very low probability of exploitation in the near term). Exploitation is further constrained by the requirement that a buggy intermediary proxy — one that forwards negative Content-Length values unmodified — must be present in the communication path; a KJ-HTTP-based proxy itself would not exhibit this behavior. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

The primary remediation is to upgrade Cap'n Proto (and its bundled KJ-HTTP library) to version 1.4.0 or later. Patches are available for both the master (1.x) branch (commit 2744b3c) and the v2 branch (commit e929f0b). Release tarballs are available at https://capnproto.org/capnproto-c++-1.4.0.tar.gz (Unix) and https://capnproto.org/capnproto-c++-win32-1.4.0.zip (Windows). As a temporary network-level workaround, organizations can configure upstream proxies or WAFs to reject or normalize HTTP requests containing non-numeric or negative Content-Length header values before they reach KJ-HTTP-based services (GitHub Advisory, Red Hat Bugzilla).

The advisory was published by Cap'n Proto maintainer Kentonv (Kenton Varda) on March 12, 2026, crediting researchers Chanho Kim (@HO-9) and Jihyeok Han (@HanJeouk) as finders. The Cloudflare Workers Runtime team, which maintains Cap'n Proto, confirmed that Cloudflare's production environment is not impacted but recommended all workerd users update immediately. Red Hat tracked the issue via Bugzilla (Bug 2447106) and rated it medium severity. Community discussion has been limited, consistent with the low exploitability and theoretical-only impact (GitHub Advisory, Red Hat Bugzilla).