Threat database

CVE-2026-89087 is a high-severity vulnerability in the OCaml cstruct package before version 6.3.0. It involves improper handling of indexes, classified under CWE-573 (Improper Following of Specification by Caller). This flaw can lead to impacts on confidentiality, integrity, and availability. The vulnerability affects all versions prior to 6.3.0.

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

CVE-2026-87737 is a timing side-channel vulnerability in the mirage-crypto-ec package for OCaml versions before 2.4.0. The issue arises during NIST elliptic-curve scalar multiplication where the time taken for a lookup operation can vary depending on secret data. This discrepancy can potentially allow an attacker to infer sensitive cryptographic information. The vulnerability has a medium severity rating with a CVSS score of 5.9.

CVE-2026-87736 is a medium severity vulnerability in the mirage-crypto-ec package for OCaml. It involves an out-of-bounds read when processing compressed elliptic curve public keys. This flaw affects versions prior to 2.3.0 and can cause a denial of service due to application crashes but does not impact confidentiality or integrity.

CVE-2026-87735 is a medium severity vulnerability in the mirage-crypto-pk package for OCaml that affects versions before 2.3.0. It involves an undocumented exception for small messages during RSA encryption or decryption, related to improper validation of specified quantity in input. The issue does not impact confidentiality or integrity but may cause availability issues. No known exploits are reported, and no official patch information is provided.

A vulnerability in the mirage-crypto-ec library for OCaml versions before 2.2.0 allows improper certificate validation. The ECDSA functions for P256, P384, and P521 curves accept the encoding of the point at infinity (0x00) as a valid public key. This flaw enables forging signatures without possessing the private key.

CVE-2026-87732 is a vulnerability in the mirage-crypto package for OCaml versions before 2.2.0. The AES.GCM and Chacha20 authenticate_decrypt_into functions decrypt data into a buffer before verifying the cryptographic tag. If the tag is forged, the functions return false but the buffer still contains the decrypted plaintext, potentially exposing sensitive data.

CVE-2026-57825 is a medium severity vulnerability in the opam package manager for OCaml. Versions before 2.5.2 mishandle symbolic links during the processing of .install files, allowing the sandbox protection mechanism to be bypassed. This flaw can lead to integrity violations but does not impact confidentiality or availability.

An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.