OSEC-2026-26

See a problem?
Import Source
https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-26.json
JSON Data
https://api.test.osv.dev/v1/vulns/OSEC-2026-26
Published
2026-10-23T21:30:00Z
Modified
2026-10-23T22:15:03Z
Severity
  • 4.5 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
runtime_events user event name-based type confusion
Details

ANT-2026-DTBY2HWS

Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.

This would never be encountered in a real program but can lead to a crash.

Fix

Validate event type against expected type, report a corrupt stream on mismatch.

Am I affected?

If the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.

Timeline

  • 2026-08-24: vulnerability was found
  • 2026-08-27: forwarded report to security@ocaml.org
  • 2027-10-20: fix merged to trunk
Database specific 
{
    "cwe": [
        "CWE-20",
        "CWE-122"
    ],
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-26.md",
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-26.json"
}
Credits
    • Anthropic - REPORTER
    • Hannes Mehnert - COORDINATOR
    • Edwin Török - COORDINATOR
    • Edwin Török - REMEDIATION_REVIEWER
    • Sadiq Jaffer - REMEDIATION_DEVELOPER

Affected packages

opam / ocaml

Package

Name
ocaml
Purl
pkg:opam/ocaml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.5.2
Type
GIT
Repo
https://github.com/ocaml/ocaml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ac2fae847a9c2c35ae3bba90a19adbe5d0cc6f59
Type
GIT
Repo
https://github.com/ocaml/ocaml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
de10a6b03a471821cb0b868223e5331b919f48c0

Affected versions

3.*
3.07
3.07+1
3.07+2
3.08.0
3.08.1
3.08.2
3.08.3
3.08.4
3.09.0
3.09.1
3.09.2
3.09.3
3.10.0
3.10.1
3.10.2
3.11.0
3.11.1
3.11.2
3.12.0
3.12.1
4.*
4.00.0
4.00.1
4.01.0
4.02.0
4.02.1
4.02.2
4.02.3
4.02.4
4.03.0
4.03.1
4.04.0
4.04.1
4.04.2
4.04.3
4.05.0
4.05.1
4.06.0
4.06.1
4.06.2
4.07.0
4.07.1
4.07.2
4.08.0
4.08.1
4.08.2
4.09.0
4.09.1
4.09.2
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.11.1
4.11.2
4.11.3
4.12.0
4.12.1
4.12.2
4.13.0
4.13.1
4.13.2
4.14.0
4.14.1
4.14.2
4.14.3
4.14.4
4.14.5
5.*
5.0.0
5.0.1
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha1
5.5.0-alpha2
5.5.0-alpha3
5.5.0-beta1
5.5.0-rc1
5.5.1
Other
flambda_fork_point

Ecosystem specific 

{
    "affected_bindings": [
        "Runtime_events.read_poll"
    ],
    "opam_constraint": "ocaml {< \"5.5.2\"}"
}

Database specific

source 
"https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-26.json"