CVE-2026-87734 OCaml CVE debrief

Who should care

Defenders responsible for OCaml systems and applications using the utcp package should assess exposure and prioritize verification and updates.

Why it matters

Defenders should care about CVE-2026-87734 because it allows remote denial of service via out-of-order segment reassembly in the utcp package before version 0.0.6 for OCaml. Verification and updates are necessary to mitigate potential attacks.

• Potential denial-of-service attacks via out-of-order segment reassembly
• Need to verify and update the utcp package to version 0.0.6 or later

Technical summary

The utcp package before version 0.0.6 for OCaml is vulnerable to a denial-of-service attack due to out-of-order segment reassembly. This vulnerability can be exploited remotely, allowing attackers to cause a denial of service. Defenders should prioritize verifying and updating the utcp package to version 0.0.6 or later to mitigate potential denial-of-service attacks. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity.

Defensive priority

Defenders should prioritize verifying and updating the utcp package to version 0.0.6 or later to mitigate potential denial-of-service attacks.

Recommended defensive actions

• Verify the utcp package version and update to 0.0.6 or later
• Monitor for potential denial-of-service attacks
• Review and update incident response plans

Evidence notes

The CVE record and NVD entry provide information on the vulnerability, but details on exploitation and impact are limited. There is no information on public exploitation, but defenders should verify the utcp package version and update to 0.0.6 or later. The vulnerability allows remote denial of service via out-of-order segment reassembly in the utcp package before version 0.0.6 for OCaml.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.