Most recent entries from all

EUVD-2026-365885

fkie_cve-2026-87735

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.

GHSA-7mc7-qjpc-23j7

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.

OSEC-2026-14 — RSA signature verification raises undocumented exception

Affected: opam: mirage-crypto-pk

The RSA decrypt and encrypt functions raise an Invalid_argument exception if the message is smaller than 2. This leads to X509 certificates with a signature value of 0 or 1 to throw this Invalid_argument exception instead of a proper error.

## Fix

The fix is to reuse the Insufficient_key exception, which is documented and caught further up in the stack.

## Timeline

- July 28th 2026: report to security@ocaml.org - August 7th: release of mirage-crypto-pk 2.3.0 and security advisory

UBUNTU-CVE-2026-87735

Affected: Ubuntu:22.04:LTS: ocaml-mirage-crypto, Ubuntu:24.04:LTS: ocaml-mirage-crypto, Ubuntu:26.04:LTS: ocaml-mirage-crypto

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.