https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:45:55.056324+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-367947 EUVD-2026-367947 2026-10-02T12:45:55.136841+00:00 EUVD-2026-367947 https://cve.radiocsirt.org/vuln/fkie_cve-2026-87736 fkie_cve-2026-87736 2026-10-02T12:45:55.136878+00:00

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.

 https://cve.radiocsirt.org/vuln/ghsa-x37h-cx7x-wm76 GHSA-x37h-cx7x-wm76 2026-10-02T12:45:55.136910+00:00

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.

 https://cve.radiocsirt.org/vuln/osec-2026-15 OSEC-2026-15 — EC public key out of bounds read 2026-10-02T12:45:55.136927+00:00

Affected: opam: mirage-crypto-ec

The internal Point.of_octets function is missing a length check for compressed points, and thus is raising an exception when a short buffer is provided. This affects all NIST curves (P-256, P-384, P-521) and both `Dsa.pub_of_octets` and `Dh.key_exchange` functions.

## Fix

The fix is to check the length of the provided buffer.

## Timeline

- July 28th 2026: report to security@ocaml.org - August 7th: release of mirage-crypto-pk 2.3.0 and security advisory

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-87736 UBUNTU-CVE-2026-87736 2026-10-02T12:45:55.136954+00:00

Affected: Ubuntu:22.04:LTS: ocaml-mirage-crypto, Ubuntu:24.04:LTS: ocaml-mirage-crypto, Ubuntu:26.04:LTS: ocaml-mirage-crypto

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.