CVE-2026-32240: 
NixOS vulnerability analysis and mitigation

CVE-2026-32240 is an integer overflow (numeric truncation) vulnerability in the KJ-HTTP component of Cap'n Proto, a data interchange format and capability-based RPC system. When processing HTTP messages using Transfer-Encoding: chunked, if a chunk's size is parsed to a value of 2^64 or larger, it is silently truncated to a 64-bit integer, potentially enabling HTTP request/response smuggling. All Cap'n Proto versions prior to 1.4.0 are affected; the vulnerability was disclosed on March 12, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat).

The root cause is a numeric truncation error (CWE-197) in the KJ-HTTP library's chunked transfer encoding parser, located in c++/src/kj/compat/http.c++. When parsing a hexadecimal chunk size, the code accumulated digits into a uint64_t without checking for overflow; a chunk size string representing a value ≥ 2^64 (e.g., the 17-digit hex string 10000000000000000) would silently wrap around to a small integer value, causing the library to misinterpret HTTP message boundaries (CWE-444). Exploitation requires the KJ-HTTP application to be sitting behind an HTTP proxy that forwards the malformed oversized chunk size without rewriting it — a condition the advisory notes is uncommon but plausible. The fix adds an explicit overflow check (KJ_REQUIRE(value <= (uint64_t(kj::maxValue) >> 4), ...)) before each digit accumulation step (GitHub Advisory, Patch Commit).

Successful exploitation could allow an attacker to perform HTTP request or response smuggling against applications built on KJ-HTTP, potentially leading to unauthorized access to sensitive data (low confidentiality impact) or manipulation of HTTP message routing and content (low integrity impact). Availability is not directly impacted. The vulnerability exclusively affects users of the KJ-HTTP add-on library; Cap'n Proto's core RPC functionality does not link against KJ-HTTP and is unaffected. The Cloudflare Workers Runtime (workerd) was identified as the largest known KJ-HTTP user, though Cloudflare confirmed its production environment is not impacted (GitHub Advisory).

No public proof-of-concept exploit exists and no in-the-wild exploitation has been observed as of the time of disclosure (Feedly). The EPSS score is approximately 0.045%, reflecting a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific architectural precondition — a proxy between the attacker and the KJ-HTTP server that forwards malformed chunk sizes without rewriting them — making opportunistic mass exploitation unlikely (GitHub Advisory).

1. Identify target: Locate an application using KJ-HTTP (Cap'n Proto versions < 1.4.0) that is deployed behind an HTTP proxy which forwards Transfer-Encoding: chunked messages without rewriting chunk sizes.
2. Craft malformed request: Construct an HTTP POST request using Transfer-Encoding: chunked with a chunk size value that overflows a 64-bit integer — for example, the 17-digit hex string 10000000000000000 (representing 2^64), which truncates to 0 after overflow.
3. Send through proxy: Route the crafted request through the intermediary proxy, relying on the proxy to forward the oversized chunk size header unmodified to the KJ-HTTP backend.
4. Exploit boundary confusion: The KJ-HTTP server interprets the truncated chunk size as a small (or zero) value, causing a mismatch in perceived HTTP message boundaries between the proxy and the backend server, enabling request or response smuggling.
5. Achieve objective: Leverage the smuggled request to poison the HTTP request queue, bypass security controls, access other users' responses, or inject malicious content into subsequent HTTP transactions (GitHub Advisory, Patch Commit).

• Network: HTTP POST requests with Transfer-Encoding: chunked headers containing chunk size values of 17 or more hexadecimal digits (e.g., 10000000000000000 or larger), particularly if forwarded by an upstream proxy.
• Logs: HTTP server access logs showing requests with anomalous chunk size values; KJ-HTTP server logs containing KJ_REQUIRE failure messages such as "HTTP chunk size overflow" or "invalid HTTP chunk size" followed by HTTP 500 Internal Server Error responses.
• Network: Unexpected or mismatched HTTP response content delivered to clients that did not originate the corresponding request, which may indicate successful smuggling.

Upgrade Cap'n Proto to version 1.4.0 or later, which contains the fix for both this vulnerability and the related CVE-2026-32239. Patched releases are available as source tarballs for Unix (capnproto-c++-1.4.0.tar.gz) and Windows (capnproto-c++-win32-1.4.0.zip). No configuration-based workaround is available; organizations should prioritize patching any KJ-HTTP deployments exposed to untrusted network input, especially those behind HTTP proxies (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was discovered by security researchers Chanho Kim (@HO-9) and Jihyeok Han (@HanJeouk), who were credited in the official GitHub Security Advisory. The Cap'n Proto maintainer (kentonv) noted that the Cloudflare Workers Runtime team — the primary maintainer of Cap'n Proto — investigated and confirmed that Cloudflare's production environment is not impacted, though open-source workerd users may be at risk under specific proxy configurations. Red Hat tracked the issue via Bugzilla and assigned it medium severity (GitHub Advisory, Red Hat Bugzilla).