Cap'n Proto’s KJ-HTTP library contains an integer overflow caused by converting a negative Content-Length header to an unsigned value, resulting in an unrealistically large length. This flaw can theoretically allow an attacker to craft HTTP requests or responses that could be mistakenly merged or split by a server, leading to HTTP request smuggling. The weakness is classified as CWE-190, CWE-444, and CWE-681.

The vulnerability affects Cap'n Proto releases prior to 1.4.0. Any software that embeds the KJ-HTTP component from these versions is potentially vulnerable. The fix was introduced in version 1.4.0.

The CVSS base score of 6.3 indicates moderate severity. The EPSS score is below 1 %, and the issue is not listed in the CISA KEV catalog, suggesting a low likelihood of current exploitation. The attack vector would require an attacker to send malicious HTTP traffic to a target that uses the vulnerable library; this is inferred from the nature of the bug, as the description does not state a confirmed exploitation path. Overall, the risk is moderate, but actual exploitation would demand a reachable HTTP endpoint and a client capable of sending the crafted headers.