https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:45:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-367944 EUVD-2026-367944 https://cve.radiocsirt.org/vuln/euvd-2026-367944 https://cve.radiocsirt.org/vuln/fkie_cve-2026-89087 <p>The cstruct package before 6.3.0 for OCaml mishandles indexes.</p> <p>The cstruct package before 6.3.0 for OCaml mishandles indexes.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-89087 https://cve.radiocsirt.org/vuln/ghsa-32j6-362j-46jc <p>The cstruct package before 6.3.0 for OCaml mishandles indexes.</p> <p>The cstruct package before 6.3.0 for OCaml mishandles indexes.</p> https://cve.radiocsirt.org/vuln/ghsa-32j6-362j-46jc https://cve.radiocsirt.org/vuln/osec-2026-20 <p><strong>Affected:</strong> opam: cstruct</p> <p>Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data.</p> <p>## Impact</p> <p>- `Cstruct.filter_map` writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped. - `Cstruct.tail ~rev:true` removes two bytes instead of one and raises an exception for single-byte views. - `Cstruct.cuts ~rev:true` may compare input against the wrong data, split at incorrect positions, and construct results using offsets outside the requested view. - `Cstruct.find` and `Cstruct.find_sub ~rev:true` may return slices from the wrong location when operating on non-zero-offset views.</p> <p>These are a set of logical indexing and bounds-calculation errors (CWE-682), and not direct memory-safety vulnerabilities. However, affected operations may return corrupted data, raise an unexpected exception, split input incorrectly, or return bytes outside the requested Cstruct view but still within its backing buffer.</p> <p>In security-sensitive parsers, this could cause validation bypasses, denial of service, or unintended disclosure of adjacent buffer contents.</p> <p>## Workarounds</p> <p>Users unable to upgrade cstruct should backport the corresponding source changes. There is no configuration-based mitigation since these are buggy library calls.</p> <p>## References</p> <p>Discovered via [Scrutineer](https://github.com/alpha-omega-security/scrutineer) and Deepseek GLM-5.3 Flash running locally.</p> <p>## Timeline</p> <p>- 2026-09-04: reported via GitHub to…</p> <p><strong>Affected:</strong> opam: cstruct</p> <p>Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data.</p> <p>## Impact</p> <p>- `Cstruct.filter_map` writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped. - `Cstruct.tail ~rev:true` removes two bytes instead of one and raises an exception for single-byte views. - `Cstruct.cuts ~rev:true` may compare input against the wrong data, split at incorrect positions, and construct results using offsets outside the requested view. - `Cstruct.find` and `Cstruct.find_sub ~rev:true` may return slices from the wrong location when operating on non-zero-offset views.</p> <p>These are a set of logical indexing and bounds-calculation errors (CWE-682), and not direct memory-safety vulnerabilities. However, affected operations may return corrupted data, raise an unexpected exception, split input incorrectly, or return bytes outside the requested Cstruct view but still within its backing buffer.</p> <p>In security-sensitive parsers, this could cause validation bypasses, denial of service, or unintended disclosure of adjacent buffer contents.</p> <p>## Workarounds</p> <p>Users unable to upgrade cstruct should backport the corresponding source changes. There is no configuration-based mitigation since these are buggy library calls.</p> <p>## References</p> <p>Discovered via [Scrutineer](https://github.com/alpha-omega-security/scrutineer) and Deepseek GLM-5.3 Flash running locally.</p> <p>## Timeline</p> <p>- 2026-09-04: reported via GitHub to…</p> https://cve.radiocsirt.org/vuln/osec-2026-20 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-89087 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ocaml-cstruct, Ubuntu:24.04:LTS: ocaml-cstruct, Ubuntu:26.04:LTS: ocaml-cstruct</p> <p>The cstruct package before 6.3.0 for OCaml mishandles indexes.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ocaml-cstruct, Ubuntu:24.04:LTS: ocaml-cstruct, Ubuntu:26.04:LTS: ocaml-cstruct</p> <p>The cstruct package before 6.3.0 for OCaml mishandles indexes.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-89087