Ocaml
8 CVEs across 3 Ocaml products. Browse Ocaml vulnerabilities, severities, and proof-of-concept exploits.
Ocaml products with known CVEs
Ocaml CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-41082 | High | 7.3 | 2026-04-16 | In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. |
CVE-2026-34353 | Medium | 5.9 | 2026-03-27 | In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed. |
CVE-2026-28364 | High | 7.9 | 2026-02-27 | In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-pha… |
CVE-2018-9838 | Critical | 9.8 | 2018-04-06 | The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled da… |
CVE-2017-9779 | High | 7.8 | 2017-09-07 | OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact." |
CVE-2017-9772 | Critical | 9.8 | 2017-06-23 | Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setu… |
CVE-2015-8869 | Critical | 9.1 | 2016-06-13 | OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information… |
CVE-2009-2943 | | | 2009-10-22 | The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which might allow remote a… |