OCaml vulnerabilities
We track 2 vulnerabilities in OCaml products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 10, 2026.
2vulnerabilities
1critical
1high
0exploited
8.4average CVSS score
Latest OCaml vulnerabilities
- 9.1 Critical severity
jose: Improper Verification of Cryptographic Signature
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.
- 7.8 High severity
OCaml: Buffer Over-read
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function,