CVE-2026-89087 | High | 7.3 | 2026-09-10 | The cstruct package before 6.3.0 for OCaml mishandles indexes. |
CVE-2026-89086 | Critical | 9.1 | 2026-09-10 | In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the… |
CVE-2026-87736 | Medium | 4.3 | 2026-09-09 | An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. |
CVE-2026-87735 | Medium | 4.3 | 2026-09-09 | An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or… |
CVE-2026-87734 | High | 7.5 | 2026-09-09 | An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service. |
CVE-2026-87732 | Medium | 6.2 | 2026-09-09 | An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into funct… |
CVE-2026-57825 | Medium | 5.7 | 2026-09-09 | In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files. |
CVE-2026-41082 | High | 7.3 | 2026-04-16 | In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. |
CVE-2026-34353 | Medium | 5.9 | 2026-03-27 | In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed. |
CVE-2026-28364 | High | 7.9 | 2026-02-27 | In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-pha… |
CVE-2018-9838 | Critical | 9.8 | 2018-04-06 | The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled da… |
CVE-2017-9779 | High | 7.8 | 2017-09-07 | OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact." |
CVE-2017-9772 | Critical | 9.8 | 2017-06-23 | Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setu… |
CVE-2015-8869 | Critical | 9.1 | 2016-06-13 | OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information… |
CVE-2009-2943 | | | 2009-10-22 | The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which might allow remote a… |