OCaml

Products

Exploited and recent CVEs

• CVE-2026-89087 High 7.3 The cstruct package before 6.3.0 for OCaml mishandles indexes. 0.3%
• CVE-2026-89086 Critical 9.1 In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required ste 0.3%
• CVE-2026-87737 Medium 5.9 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication: the time required for a lookup can depend 0.3%
• CVE-2026-87736 Medium 4.3 An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. 0.4%
• CVE-2026-87735 Medium 4.3 An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption. 0.2%
• CVE-2026-87734 High 7.5 An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service. 0.5%
• CVE-2026-87733 Medium 6.2 An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public 0.2%
• CVE-2026-87732 Medium 6.2 An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write the decrypted plaintext into a 0.1%
• CVE-2026-57825 Medium 5.7 In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files. 0.5%
• CVE-2026-41082 High 7.3 In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. 0.2%
• CVE-2026-34353 Medium 5.9 In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed. 0.1%
• CVE-2026-28364 High 7.9 In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems 0.2%