{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2022-46149",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-46149",
    "idYear": 2022,
    "status": "PUBLISHED",
    "publishedAt": "2022-11-30T00:00:00.000Z",
    "updatedAt": "2025-04-23T16:33:43.499Z",
    "importedAt": "2026-10-24T01:56:45.230Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.",
      "summary": "Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap'n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. The `capnp` Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2.",
      "affected": [
        {
          "vendor": "capnproto",
          "product": "capnproto",
          "versions": [
            {
              "version": "< 0.7.1",
              "status": "affected"
            },
            {
              "version": ">= 0.8.0, < 0.8.1",
              "status": "affected"
            },
            {
              "version": ">= 0.9.0, < 0.9.2",
              "status": "affected"
            },
            {
              "version": ">= 0.10.0, < 0.10.3",
              "status": "affected"
            },
            {
              "version": ">= 0.13.0, < 0.13.7",
              "status": "affected"
            },
            {
              "version": ">= 0.14.0, < 0.14.11",
              "status": "affected"
            },
            {
              "version": ">= 0.15.0, < 0.15.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}