https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:34:37.888677+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-365885 EUVD-2026-365885 2026-10-02T22:34:37.971730+00:00 EUVD-2026-365885 https://cve.radiocsirt.org/vuln/fkie_cve-2026-87735 fkie_cve-2026-87735 2026-10-02T22:34:37.971772+00:00

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.

 https://cve.radiocsirt.org/vuln/ghsa-7mc7-qjpc-23j7 GHSA-7mc7-qjpc-23j7 2026-10-02T22:34:37.971806+00:00

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.

 https://cve.radiocsirt.org/vuln/osec-2026-14 OSEC-2026-14 — RSA signature verification raises undocumented exception 2026-10-02T22:34:37.971822+00:00

Affected: opam: mirage-crypto-pk

The RSA decrypt and encrypt functions raise an Invalid_argument exception if the message is smaller than 2. This leads to X509 certificates with a signature value of 0 or 1 to throw this Invalid_argument exception instead of a proper error.

## Fix

The fix is to reuse the Insufficient_key exception, which is documented and caught further up in the stack.

## Timeline

- July 28th 2026: report to security@ocaml.org - August 7th: release of mirage-crypto-pk 2.3.0 and security advisory

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-87735 UBUNTU-CVE-2026-87735 2026-10-02T22:34:37.971850+00:00

Affected: Ubuntu:22.04:LTS: ocaml-mirage-crypto, Ubuntu:24.04:LTS: ocaml-mirage-crypto, Ubuntu:26.04:LTS: ocaml-mirage-crypto

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.