Back Linuxsecurity

Ubuntu 26.04 Cap'n Proto Important HTTP Request Smuggling Issues USN-8650

Linuxsecurity •LinuxSecurity Advisories • August 19, 2026

Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×

Several security issues were fixed in Cap'n Proto. Software Description: - capnproto: Fast data interchange format and capability-based RPC system Details: Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values or excessively large chunk sizes when processing HTTP messages. An attacker could possibly use these issues to cause HTTP messages to be interpreted inconsistently, resulting in HTTP request or response smuggling. (CVE-2026-32239, CVE-2026-32240)

Several security issues were fixed in Cap'n Proto.

Software Description:

- capnproto: Fast data interchange format and capability-based RPC system

Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly

handled negative Content-Length values or excessively large chunk sizes

when processing HTTP messages. An attacker could possibly use these

issues to cause HTTP messages to be interpreted inconsistently,

resulting in HTTP request or response smuggling. (CVE-2026-32239,

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libcapnp-1.1.0 1.1.0-2.1ubuntu0.1~esm1 Available with Ubuntu Pro libcapnp-dev 1.1.0-2.1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS libcapnp-1.0.1 1.0.1-4ubuntu0.1~esm1 Available with Ubuntu Pro libcapnp-dev 1.0.1-4ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS libcapnp-0.8.0 0.8.0-2ubuntu2+esm1 Available with Ubuntu Pro libcapnp-dev 0.8.0-2ubuntu2+esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS libcapnp-0.7.0 0.7.0-6ubuntu0.1~esm1 Available with Ubuntu Pro libcapnp-dev 0.7.0-6ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libcapnp-0.6.1 0.6.1-1ubuntu1+esm1 Available with Ubuntu Pro libcapnp-dev 0.6.1-1ubuntu1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2026-32239, CVE-2026-32240

Ubuntu Security Notice USN-8650-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical HTTP Request Smuggling Vulnerabilities in Cap'n Proto Two vulnerabilities (CVE-2026-32239, CVE-2026-32240) in Cap'n Proto were discovered by Chanho Kim and Jihyeok Han, allowing attackers to exploit improper handling of negative Content-Length values and large chunk sizes in HTTP messages. This could lead to HTTP request or response smuggling, potentially affecting systems using Cap'n Proto across multiple Ubuntu versions. The vulnerabilities were published on 2026-03-12. Users are advised to update their systems to the patched versions provided in the advisories. A standard system update will apply the necessary changes. The affected Ubuntu versions include 26.04, 24.04, 22.04, 20.04, and 18.04. 2 sources 71

Extracted Entities

Ubuntu 26.04 Cap'n Proto Important HTTP Request Smuggling Issues USN-8650

The full story

Extracted Entities

Companies (1)

CVEs (2)

Vulnerabilities (1)