OSEC-2026-25 json
Heap buffer overflow in the OCaml `runtime_events` consumer when parsing an oversized custom user event
published 2026-10-23 16 d ago modified 2026-11-06 2 d ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
ANT-2026-0JXJVEVY
Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.
This would never be encountered in a real program but can lead to a crash.
## Fix
Check message lengths for all runtime event types, report a corrupt stream on mismatch.
## Am I affected?
If the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.
## Timeline
- 2026-08-24: vulnerability was found - 2026-08-27: forwarded report to security@ocaml.org - 2027-09-05: fix merged to trunk
Patch / fix
- opam ocaml 5.5.2
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| opam | ocaml | >=5, <5.5.2 |
5.5.2 |
Sources
- OSV OSEC-2026-25
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.