Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

17 records

Vendor: OCaml Clear all filters
TI-2026-60369 CVE-2026-89086 · GHSA-9r5j-37q2-cffw

Improper signature verification in OCaml jose

Priority HIGH 80

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00276 Published 2026-09-10 Fixed in 0.11.0 CWE-347
TI-2026-59891 CVE-2026-87736 · GHSA-x37h-cx7x-wm76

Out-of-bounds read in OCaml mirage-crypto-ec

Priority LOW 20

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00359 Published 2026-09-09 Fixed in 2.3.0 CWE-125
TI-2026-26640 CVE-2026-34353 · GHSA-6p45-jv22-32gp

Integer overflow in OCaml

Priority LOW 25

In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.

CVSS 3.1MEDIUM 5.9 Local No auth No interaction EPSS 0.00116 Published 2026-03-27 Fix deferred CWE-190
TI-2026-22643 CVE-2026-28364 · GHSA-g54x-7hpm-29q8

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal…

Priority LOW 34

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain.

CVSS 3.1HIGH 7.9 Local No auth No interaction EPSS 0.00241 Published 2026-02-27 Partial fix · 4.14.3, 5.4.1 CWE-126
TI-2018-07003 CVE-2018-9838 · GHSA-wc7m-73fq-26mj

The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml…

Priority MEDIUM 49

The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attack…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04173 Published 2018-04-06 Fix deferred CWE-190
TI-2017-07154 CVE-2017-9772 · GHSA-jggq-92ww-7r4w

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows…

Priority MEDIUM 48

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CA…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03496 Published 2017-06-23 No fix listed
TI-2015-07299 CVE-2015-8869 · GHSA-3jg5-m986-f428

OCaml before 4.03.0 does not properly handle sign extensions, which allows remote…

Priority MEDIUM 47

OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.05313 Published 2016-06-13 Fixed CWE-119