CVE-2026-87735: CWE-1284 Improper Validation of Specified Quantity in Input in OCaml mirage-crypto-pk
Affects OCaml mirage-crypto-pkSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEs
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LWhat to do
AI-suggested
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. No specific mitigation steps are documented.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| OCamlmirage-crypto-pk | Affected
| Fixed in
|
Goocaml/mirage-crypto-pkpkg:golang/ocaml/mirage-crypto-pkOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
CVE-2026-87735 is a medium severity vulnerability in the mirage-crypto-pk package for OCaml that affects versions before 2.3.0. It involves an undocumented exception for small messages during RSA encryption or decryption, related to improper validation of specified quantity in input. The issue does not impact confidentiality or integrity but may cause availability issues. No known exploits are reported, and no official patch information is provided.