{"id":"OSEC-2026-25","aliases":[],"status":"published","title":"Heap buffer overflow in the OCaml `runtime_events` consumer when parsing an oversized custom user event","description":"ANT-2026-0JXJVEVY\n\nCustom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.\n\nThis would never be encountered in a real program but can lead to a crash.\n\n## Fix\n\nCheck message lengths for all runtime event types, report a corrupt stream on mismatch.\n\n## Am I affected?\n\nIf the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.\n\n## Timeline\n\n- 2026-08-24: vulnerability was found\n- 2026-08-27: forwarded report to security@ocaml.org\n- 2027-09-05: fix merged to trunk","severity":{"version":"4.0","score":4.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-23T21:30:00Z","modified":"2026-11-06T13:45:03Z","fixes":[{"ecosystem":"opam","package":"ocaml","fixed_in":["5.5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"opam","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5"},{"fixed":"5.5.2"}]}],"versions":["5.0.0","5.0.1","5.1.0","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1"]}],"sources":{"osv":[{"id":"OSEC-2026-25","title":"Heap buffer overflow in the OCaml `runtime_events` consumer when parsing an oversized custom user event","description":"ANT-2026-0JXJVEVY\n\nCustom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.\n\nThis would never be encountered in a real program but can lead to a crash.\n\n## Fix\n\nCheck message lengths for all runtime event types, report a corrupt stream on mismatch.\n\n## Am I affected?\n\nIf the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.\n\n## Timeline\n\n- 2026-08-24: vulnerability was found\n- 2026-08-27: forwarded report to security@ocaml.org\n- 2027-09-05: fix merged to trunk","status":"published","published":"2026-10-23T21:30:00Z","modified":"2026-11-06T19:14:06.493111507Z","cvss":[{"version":"4.0","score":4.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-06T19:35:48.25184Z"}]}}