{"id":"CVE-2026-87735","aliases":["DEBIAN-CVE-2026-87735","EUVD-2026-74621","GHSA-7mc7-qjpc-23j7","OSEC-2026-14","UBUNTU-CVE-2026-87735"],"status":"published","title":"An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an...","description":"An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0023,"percentile":0.1389,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284"],"published":"2026-08-07T13:00:00Z","modified":"2026-11-06T13:45:03Z","fixes":[{"ecosystem":"Debian:14","package":"ocaml-mirage-crypto","fixed_in":["2.3.0-1"],"sources":["osv"]},{"ecosystem":"opam","package":"mirage-crypto-pk","fixed_in":["2.3.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.11.1-1","0.11.1-2","0.11.1-3","0.11.2-1","0.11.2-2","0.11.3-1","1.1.0-1","1.1.0-2","2.0.0-1","2.0.1-1","2.0.2-1","2.0.3-1","2.1.0-1","2.2.0-1","2.2.0-2","2.3.0-1","2.4.0-1","2.4.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1","2.0.2-1","2.0.3-1","2.1.0-1","2.2.0-1","2.2.0-2","2.3.0-1","2.4.0-1","2.4.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1"}]}],"versions":["2.0.0-1","2.0.1-1","2.0.2-1","2.0.3-1","2.1.0-1","2.2.0-1","2.2.0-2"]},{"source":"osv","ecosystem":"opam","package":"mirage-crypto-pk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}],"versions":["0.6.0","0.6.1","0.6.2","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.8.10","0.9.0","0.9.1","0.9.2","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","1.0.0","1.1.0","1.2.0","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.2.0"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.5-4","0.10.5-4build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1-3","0.11.2-1","0.11.2-1build1","0.11.2-2build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2-1build5","2.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-1build1","2.0.2-1build1","2.0.2-1build2","2.0.2-1build3","2.0.2-1build5"]}],"products":[{"vendor":"ocaml","product":"mirage-crypto-pk"}],"references":[{"url":"https://osv.dev/vulnerability/OSEC-2026-14","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87735"},{"url":"https://github.com/advisories/GHSA-7mc7-qjpc-23j7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87735","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-87735","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87735","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-87735","description":"An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.","status":"published","published":"2026-09-09T04:16:24.808Z","modified":"2026-09-09T18:39:57.065Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-74621","description":"An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.","status":"published","published":"2026-09-09T04:16:24Z","modified":"2026-09-09T18:39:57Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:25.986684Z"}],"ghsa":[{"id":"GHSA-7mc7-qjpc-23j7","title":"An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an...","description":"An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.","status":"published","published":"2026-09-09T06:31:39Z","modified":"2026-09-09T06:31:40Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T15:11:37.523128Z"}],"nvd":[{"id":"CVE-2026-87735","description":"An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.","status":"published","published":"2026-09-09T05:18:20.73Z","modified":"2026-09-09T19:17:50.43Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"DEBIAN-CVE-2026-87735","description":"An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.","status":"published","published":"2026-09-09T05:18:20.73Z","modified":"2026-10-01T03:03:52.556457024Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"OSEC-2026-14","title":"RSA signature verification raises undocumented exception","description":"The RSA decrypt and encrypt functions raise an Invalid_argument exception if the\nmessage is smaller than 2. This leads to X509 certificates with a signature\nvalue of 0 or 1 to throw this Invalid_argument exception instead of a proper\nerror.\n\n## Fix\n\nThe fix is to reuse the Insufficient_key exception, which is documented and\ncaught further up in the stack.\n\n## Timeline\n\n- July 28th 2026: report to security@ocaml.org\n- August 7th: release of mirage-crypto-pk 2.3.0 and security advisory","status":"published","published":"2026-08-07T13:00:00Z","modified":"2026-11-06T13:45:03.713683735Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-06T14:15:37.404895Z"},{"id":"UBUNTU-CVE-2026-87735","description":"An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.","status":"published","published":"2026-09-09T05:18:00Z","modified":"2026-10-17T13:01:14.930334853Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"}]}}