Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21062-1

Опубликовано: 26 июн. 2026
Источник: suse-cvrf

Описание

Security update for capnproto

This update for capnproto fixes the following issues:

Update to version 1.4.0.

Security issues fixed:

  • CVE-2026-32239: negative Content-Length conversion treated as impossibly large length by KJ-HTTP can lead to HTTP smuggling (bsc#1259638).
  • CVE-2026-32240: integer overflow when KJ-HTTP Transfer-Encoding chunk size is parsed to a value of 2^64 or larger can lead to HTTP smuggling (bsc#1259639).

Other updates and bugfixes:

  • Have stdcoro use ::std namespace.
  • Disable stack check when HWASan is used.
  • Fix benign buffer overrun in async readMessage().
  • Shared library naming changes from libsomething-%{version}.so to libsomething.so.%{version}.

Список пакетов

openSUSE Leap 16.0
capnproto-1.4.0-160000.1.1
libcapnp-1_4_0-1.4.0-160000.1.1
libcapnp-devel-1.4.0-160000.1.1

Ссылки

Описание

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

Затронутые продукты
openSUSE Leap 16.0:capnproto-1.4.0-160000.1.1
openSUSE Leap 16.0:libcapnp-1_4_0-1.4.0-160000.1.1
openSUSE Leap 16.0:libcapnp-devel-1.4.0-160000.1.1
Ссылки

Описание

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.

Затронутые продукты
openSUSE Leap 16.0:capnproto-1.4.0-160000.1.1
openSUSE Leap 16.0:libcapnp-1_4_0-1.4.0-160000.1.1
openSUSE Leap 16.0:libcapnp-devel-1.4.0-160000.1.1
Ссылки
Уязвимость openSUSE-SU-2026:21062-1