PT-2026-88814 · Ocaml+1 · Mirage-Crypto-Pk

CVE-2026-87735

·

Publicado

2026-08-07

·

Atualizado

2026-09-09

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
The RSA decrypt and encrypt functions raise an Invalid argument exception if the message is smaller than 2. This leads to X509 certificates with a signature value of 0 or 1 to throw this Invalid argument exception instead of a proper error.

Fix

The fix is to reuse the Insufficient key exception, which is documented and caught further up in the stack.

Timeline

  • July 28th 2026: report to security@ocaml.org
  • August 7th: release of mirage-crypto-pk 2.3.0 and security advisory

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

CVE-2026-87735
OSEC-2026-14

Produtos afetados

Mirage-Crypto-Pk