OCaml vulnerabilities

Newest CVEs

• CVE-2026-89087

  The cstruct package before 6.3.0 for OCaml mishandles indexes.

  OCaml · cstruct

  High7.3
• CVE-2026-89086

  In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the…

  OCaml · jose

  Critical9.1
• CVE-2026-87737

  An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication:…

  OCaml · mirage-crypto-ec

  Medium5.9
• CVE-2026-87736

  An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.

  OCaml · mirage-crypto-ec

  Medium4.3
• CVE-2026-87735

  An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or…

  OCaml · mirage-crypto-pk

  Medium4.3
• CVE-2026-87734

  An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.

  OCaml · utcp

  High7.5
• CVE-2026-87733

  An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the…

  OCaml · mirage-crypto-ec

  Medium6.2
• CVE-2026-87732

  An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into…

  OCaml · mirage-crypto

  Medium6.2
• CVE-2026-57825

  In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.

  OCaml · opam

  Medium5.7
• CVE-2026-41082

  In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

  OCaml · opam

  High7.3