CVE-2026-87734

Out‑of‑Order Segment Reassembly Denial of Service in OCaml utcp

Published Sep 9, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.

Analysis

Technical impact

The utcp package for OCaml contains a flaw that permits an attacker to send TCP packets out of order, causing the reassembly logic to misprocess data and ultimately crash the service. This issue is classified as CWE‑923: Out‑of‑Order Data Processing and results in a denial of service that can be triggered without authentication.

Affected Systems

Any deployment of the utcp library older than version 0.0.6 is affected. The vulnerability is present in the OCaml:utcp package distributed by the OCaml community.

Risk and Exploitability

The flaw carries a CVSS score of 7.5, indicating a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The likely attack vector involves an untrusted remote host sending crafted segments to the utcp listener; no local privileges or authentication are required to trigger the crash. Because the service can be made unavailable by an external attacker, immediate remediation is advised.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OCaml

utcp

unaffected

Version	Status	Constraints
`0`	affected	< 0.0.6

No data.

Vendor Product Versions

Ocaml

Utcp

Version	Status	Scheme	Platform
`[0,0.0.6)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the utcp package to version 0.0.6 or newer.
Restart all applications that use utcp so that the updated library is loaded.
Implement input validation to enforce correct packet ordering before data processing.

Generated by OpenCVE AI on September 9, 2026 at 11:41 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.507% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://osv.dev/vulnerability/OSEC-2026-11

History

Sep 14, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ocaml Ocaml utcp
Vendors & Products		Ocaml Ocaml utcp

Sep 9, 2026 12:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Out‑of‑Order Segment Reassembly Denial of Service in OCaml utcp

Sep 9, 2026 4:30 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.
Weaknesses		CWE-923
References		https://osv.dev/vulnerability/OSEC-2026-11
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`