Cap'n Proto implements a data interchange and RPC system that parses HTTP chunked transfer encoding. An integer overflow occurs when the parsed chunk size equals or exceeds 2^64; the value is truncated to a 64‑bit integer. This flaw can be leveraged for HTTP request or response smuggling, a technique that allows an attacker to deliver data that is interpreted differently by a server and a downstream proxy. The weakness is classified as an integer overflow (CWE‑190) and unsafe conversion (CWE‑197). The potential impact includes denial of service, bypassing of security controls, or information disclosure if the smuggled payload reaches a privileged component.

All deployments of Cap'n Proto that use the Transfer‑Encoding: chunked mechanism and run a version older than 1.4.0 are affected. The product identifier is capnproto:capnproto. Specific sub‑versions are not enumerated, but any build released before the 1.4.0 update is vulnerable.

The CVSS base score is 6.3, indicating a medium severity. The EPSS score is below 1%, suggesting a low likelihood of real‑world exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via crafted HTTP traffic that forces the Cap'n Proto library to parse an oversized chunked size. The vulnerability is exploitable when the library processes an HTTP request or response, which typically occurs in a remote context. No additional conditions or privileges are required beyond sending the malformed request.