Vendor
OCaml
17 known vulnerabilities in products by OCaml, 0 of them actively exploited (CISA KEV).
Key figures
17
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2018-9838 | OCaml: Deserialization of Untrusted Data | 9.8 | |
| Critical | CVE-2015-8869 | OCaml: Buffer Overflow | 9.1 | |
| Critical | CVE-2017-9772 | OCaml: security vulnerability | 9.8 | |
| High | CVE-2026-87734 | OCaml Utcp: Improper Restriction of Communication Channel to Intended Endpoints | 7.5 | |
| Critical | CVE-2026-89086 | OCaml Jose: Improper Verification of Cryptographic Signature | 9.1 | |
| High | CVE-2026-89087 | OCaml Cstruct: Improper Following of Specification by Caller | 7.3 | |
| Medium | CVE-2026-57825 | OCaml opam (OCaml Package Manager): UNIX Symbolic Link (Symlink) Following | 5.7 | |
| Medium | CVE-2026-87737 | OCaml Mirage-crypto-ec: Observable Timing Discrepancy | 5.9 | |
| High | CVE-2026-28364 | OCaml: Buffer Over-read | 7.9 | |
| Medium | CVE-2026-87733 | OCaml Mirage-crypto-ec: Improper Certificate Validation | 6.2 | |
| Medium | CVE-2026-87732 | OCaml Mirage-crypto: Improper Verification of Cryptographic Signature | 6.2 | |
| High | CVE-2017-9779 | OCaml: security vulnerability | 7.8 | |
| Medium | CVE-2026-87736 | OCaml Mirage-crypto-ec: Out-of-bounds Read | 4.3 | |
| Not rated | CVE-2009-2943 | OCaml Postgresql-ocaml: security vulnerability | — | |
| High | CVE-2026-41082 | OCaml opam (OCaml Package Manager): Path Traversal: '../filedir' | 7.3 | |
| Medium | CVE-2026-87735 | OCaml Mirage-crypto-pk: Improper Validation of Specified Quantity in Input | 4.3 | |
| Medium | CVE-2026-34353 | OCaml: Integer Overflow or Wraparound | 5.9 |
Products
| Product | CVEs | Actively exploited |
|---|---|---|
| OCaml | 6 | 0 |
| Mirage-crypto-ec | 3 | 0 |