Most recent entries from all

EUVD-2026-367947

fkie_cve-2026-87736

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.

GHSA-x37h-cx7x-wm76

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.

OSEC-2026-15 — EC public key out of bounds read

Affected: opam: mirage-crypto-ec

The internal Point.of_octets function is missing a length check for compressed points, and thus is raising an exception when a short buffer is provided. This affects all NIST curves (P-256, P-384, P-521) and both `Dsa.pub_of_octets` and `Dh.key_exchange` functions.

## Fix

The fix is to check the length of the provided buffer.

## Timeline

- July 28th 2026: report to security@ocaml.org - August 7th: release of mirage-crypto-pk 2.3.0 and security advisory

UBUNTU-CVE-2026-87736

Affected: Ubuntu:22.04:LTS: ocaml-mirage-crypto, Ubuntu:24.04:LTS: ocaml-mirage-crypto, Ubuntu:26.04:LTS: ocaml-mirage-crypto

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.