OSEC-2026-26

See a problem?
Import Source
https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-26.json
JSON Data
https://api.osv.dev/v1/vulns/OSEC-2026-26
Published
2026-10-23T21:30:00Z
Modified
2026-10-28T09:30:03Z
Severity
  • 4.5 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
runtime_events user event name-based type confusion
Details

ANT-2026-DTBY2HWS

Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.

This would never be encountered in a real program but can lead to a crash.

Fix

Validate event type against expected type, report a corrupt stream on mismatch.

Am I affected?

If the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.

Timeline

  • 2026-08-24: vulnerability was found
  • 2026-08-27: forwarded report to security@ocaml.org
  • 2027-10-20: fix merged to trunk
Database specific 
{
    "cwe":  [
        "CWE-20",
        "CWE-122"
    ],
    "human_link":  "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-26.md",
    "osv":  "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-26.json"
}
Credits
    • Anthropic - REPORTER
    • Hannes Mehnert - COORDINATOR
    • Edwin Török - COORDINATOR
    • Edwin Török - REMEDIATION_REVIEWER
    • Sadiq Jaffer - REMEDIATION_DEVELOPER

Affected packages

opam / ocaml

Package

Name
ocaml
Purl
pkg:opam/ocaml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5
Fixed
5.5.2
Type
GIT
Repo
https://github.com/ocaml/ocaml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ac2fae847a9c2c35ae3bba90a19adbe5d0cc6f59
Type
GIT
Repo
https://github.com/ocaml/ocaml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
de10a6b03a471821cb0b868223e5331b919f48c0

Affected versions

5.*
5.0.0
5.0.1
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha1
5.5.0-alpha2
5.5.0-alpha3
5.5.0-beta1
5.5.0-rc1
5.5.1
Other
flambda_fork_point

Ecosystem specific 

{
    "affected_bindings":  [
        "Runtime_events.read_poll"
    ],
    "opam_constraint":  "ocaml {>= \"5\" & < \"5.5.2\"}"
}

Database specific

source 
"https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-26.json"