PT-2026-135867
تاريخ النشر
2026-10-23
·
تاريخ التحديث
2026-10-23
الوصف من
CVSS 4.0
4.5
متوسطةالمقاييسAV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
ANT-2026-0JXJVEVY
Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.
This would never be encountered in a real program but can lead to a crash.
Fix
Check message lengths for all runtime event types, report a corrupt stream on mismatch.
Am I affected?
If the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.
Timeline
- 2026-08-24: vulnerability was found
- 2026-08-27: forwarded report to security@ocaml.org
- 2027-09-05: fix merged to trunk
قابلية الاستغلال
إصلاح
المورّدون
المنتجات المتأثرة
المعرّفات ذات الصلة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾