OSEC-2026-30

See a problem?
Import Source
https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-30.json
JSON Data
https://api.osv.dev/v1/vulns/OSEC-2026-30
Published
2026-11-06T12:30:00Z
Modified
2026-11-06T13:45:02Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Ephemeron data is freed while still referenced when the key is an `Infix_tag` closure
Details

Summary

In OCaml before 4.14.5, when the key of an ephemeron is a closure with Infix_tag (a function of a mutually recursive group that is not the first function), the mark phase does not keep the ephemeron's data alive, although the key is alive. The clean phase does treat the key as alive, so it leaves the data field filled. The sweep phase then frees the data block. After a major collection the ephemeron's data field still points to the freed block.

This looks like the part of #7810 that PR #9742 did not cover. PR #9742 fixed the clean phase and the minor collector. It did not change mark_ephe_aux.

Please note that the CVSS score high is under the conditions:

  • if the application is using ephemerons,
  • and if the application is available over the network,
  • and if the attacker can find a way to exploit the memory safety issue in an attack chain.

Reproduction

[@@@alert "-old_ephemeron_api"]
let infix n = let rec f () = n and g () = f () in g

let build key n =
  let e = Ephemeron.K1.create () in
  let w = Weak.create 1 in
  let d = ref n in
  Ephemeron.K1.set_key e key;
  Ephemeron.K1.set_data e d;
  Weak.set w 0 (Some d);
  (e, w)

let run key =
  let (e, w) = build key 1 in
  Gc.full_major ();
  Printf.printf "tag=%d weak=%b check_key=%b check_data=%b\n"
    (Obj.tag (Obj.repr key)) (Weak.check w 0)
    (Ephemeron.K1.check_key e) (Ephemeron.K1.check_data e);
  ignore (Sys.opaque_identity key)

let () =
  if Sys.argv.(1) = "infix" then run (infix 1) else run (ref 1)

Obj is used only to print the tag of the key. The program does not read the data after the collection.

Timeline

  • 2026-10-04: initial report via email
  • 2026-10-09: develop and committed the fix
  • 2026-11-03: fix was reviewed and merged
  • 2026-11-06: OCaml 4.14.5 released
Database specific 
{
    "cwe": [
        "CWE-416"
    ],
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-30.md",
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-30.json"
}
Credits
    • Igor Santos-Grueiro - REPORTER
    • Hannes Mehnert - COORDINATOR
    • Florian Angeletti - REMEDIATION_REVIEWER
    • Gabriel Scherer - REMEDIATION_DEVELOPER

Affected packages

opam / ocaml

Package

Name
ocaml
Purl
pkg:opam/ocaml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.14.5

Affected versions

3.*
3.07
3.07+1
3.07+2
3.08.0
3.08.1
3.08.2
3.08.3
3.08.4
3.09.0
3.09.1
3.09.2
3.09.3
3.10.0
3.10.1
3.10.2
3.11.0
3.11.1
3.11.2
3.12.0
3.12.1
4.*
4.00.0
4.00.1
4.01.0
4.02.0
4.02.1
4.02.2
4.02.3
4.02.4
4.03.0
4.03.1
4.04.0
4.04.1
4.04.2
4.04.3
4.05.0
4.05.1
4.06.0
4.06.1
4.06.2
4.07.0
4.07.1
4.07.2
4.08.0
4.08.1
4.08.2
4.09.0
4.09.1
4.09.2
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.11.1
4.11.2
4.11.3
4.12.0
4.12.1
4.12.2
4.13.0
4.13.1
4.13.2
4.14.0
4.14.1
4.14.2
4.14.3
4.14.4

Ecosystem specific 

{
    "opam_constraint": "ocaml {< \"4.14.5\"}"
}

Database specific

source 
"https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-30.json"

Git / github.com/ocaml/ocaml

Affected ranges

Type
GIT
Repo
https://github.com/ocaml/ocaml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
da301a20833b765e268d677fe693d29fe51793ad

Affected versions

4.*
4.14.0
4.14.0-alpha1
4.14.0-alpha2
4.14.0-beta1
4.14.0-rc1
4.14.0-rc2
4.14.1
4.14.1-rc1
4.14.2
4.14.2-rc1
4.14.3
4.14.4
Other
flambda_fork_point

Database specific

source 
"https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-30.json"