Skip to main content
CVE-2026-87734VulnerabilityPublished 09/09/2026Updated 09/14/2026

CVE-2026-87734: CWE-923 Improper Restriction of Communication Channel to Intended Endpoints in OCaml utcp

Affects OCaml utcpSource CVE Database V5

CVSS 3.1 base score
7.5High
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.5% chance of exploitation in 30 days – higher than 42% of CVEs
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor vendor communications for updates and consider mitigating exposure by limiting access to the affected service until a fix is available.

Affected software

ProductAffectedFixed in
OCamlutcpAffected
  • >=0 <0.0.6
Fixed in
  • 0.0.6
Goocaml/utcppkg:golang/ocaml/utcpOther threatsAffected
  • <0.0.6
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.

Weaknesses

References