PT-2026-135867
Publicado
2026-10-23
·
Atualizado
2026-10-23
Descrição por
CVSS 4.0
4.5
MédiaMétricasAV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
ANT-2026-0JXJVEVY
Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.
This would never be encountered in a real program but can lead to a crash.
Fix
Check message lengths for all runtime event types, report a corrupt stream on mismatch.
Am I affected?
If the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.
Timeline
- 2026-08-24: vulnerability was found
- 2026-08-27: forwarded report to security@ocaml.org
- 2027-09-05: fix merged to trunk
Explorabilidade
Correção
Fornecedores
Produtos afetados
Identificadores relacionados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾