{"id":"OSEC-2026-26","summary":"runtime_events user event name-based type confusion","details":"ANT-2026-DTBY2HWS \n\nCustom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.\n\nThis would never be encountered in a real program but can lead to a crash.\n\n## Fix\n\nValidate event type against expected type, report a corrupt stream on mismatch.\n\n## Am I affected?\n\nIf the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.\n\n## Timeline\n\n- 2026-08-24: vulnerability was found\n- 2026-08-27: forwarded report to security@ocaml.org\n- 2027-10-20: fix merged to trunk","modified":"2026-10-23T22:15:03.171075795Z","published":"2026-10-23T21:30:00Z","database_specific":{"human_link":"https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-26.md","cwe":["CWE-20","CWE-122"],"osv":"https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-26.json"},"affected":[{"package":{"name":"ocaml","ecosystem":"opam","purl":"pkg:opam/ocaml"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.2"}]},{"type":"GIT","repo":"https://github.com/ocaml/ocaml","events":[{"introduced":"0"},{"fixed":"ac2fae847a9c2c35ae3bba90a19adbe5d0cc6f59"}]},{"type":"GIT","repo":"https://github.com/ocaml/ocaml","events":[{"introduced":"0"},{"fixed":"de10a6b03a471821cb0b868223e5331b919f48c0"}]}],"versions":["3.07","3.07+1","3.07+2","3.08.0","3.08.1","3.08.2","3.08.3","3.08.4","3.09.0","3.09.1","3.09.2","3.09.3","3.10.0","3.10.1","3.10.2","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","4.00.0","4.00.1","4.01.0","4.02.0","4.02.1","4.02.2","4.02.3","4.02.4","4.03.0","4.03.1","4.04.0","4.04.1","4.04.2","4.04.3","4.05.0","4.05.1","4.06.0","4.06.1","4.06.2","4.07.0","4.07.1","4.07.2","4.08.0","4.08.1","4.08.2","4.09.0","4.09.1","4.09.2","4.10.0","4.10.1","4.10.2","4.10.3","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.12.1","4.12.2","4.13.0","4.13.1","4.13.2","4.14.0","4.14.1","4.14.2","4.14.3","4.14.4","4.14.5","5.0.0","5.0.1","5.1.0","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1","flambda_fork_point","5.5.0-rc1","5.5.0-beta1","5.5.0-alpha3","5.5.0-alpha2","5.5.0-alpha1"],"ecosystem_specific":{"opam_constraint":"ocaml {\u003c \"5.5.2\"}","affected_bindings":["Runtime_events.read_poll"]},"database_specific":{"source":"https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-26.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}],"credits":[{"name":"Anthropic","type":"REPORTER"},{"name":"Hannes Mehnert","type":"COORDINATOR"},{"name":"Edwin Török","type":"COORDINATOR"},{"name":"Edwin Török","type":"REMEDIATION_REVIEWER"},{"name":"Sadiq Jaffer","type":"REMEDIATION_DEVELOPER"}]}