redexer

redexer Redexer is a reengineering tool that manipulates Android app binaries. This tool is able to parse a DEX file into an in-memory data structure; to infer with which parameters the app uses certain permissions we name this feature RefineDroid; to modify and unparse that data structure to...

Argos

Argos — Blockchain Asset Tracing Platform Argos is a multi-language blockchain investigation platform for tracing, analyzing, and visualizing fund flows on Ethereum and Bitcoin. Built with Rust, OCaml, and TypeScript/React. Architecture +-----------------------+ | Frontend React 19 | | Vite +...

infer

Infer Infer is a static analysis tool for Java, C++, Objective-C, and C. Infer is written in OCaml. Installation Read our Getting Started page for details on how to install packaged versions of Infer. To build Infer from source, see INSTALL.md. Contributing See CONTRIBUTING.md. License Infer is...

OSEC-2026-26 runtime_events user event name-based type confusion

ANT-2026-DTBY2HWS Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type which can be custom/unit/span/int and then has the same event with a different message type. This would never be encountered in a real program b...

OSEC-2026-24 Multiple issues in command quoting on Windows

ANT-2026-R7FKP7RG Win32 quotecmdfilename misses pipe/redirect metacharacters ANT-2026-SRZZ62SD Windows batch-file argument injection via maybequote/makecmdline ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped Also includes the fix for OSEC-2026-05 Filename.quotecommand...

OSEC-2026-25 Heap buffer overflow in the OCaml `runtime_events` consumer when parsing an oversized custom user event

ANT-2026-0JXJVEVY Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type which can be custom/unit/span/int and then has the same event with a different message type. This would never be encountered in a real program b...

PT-2026-122455

Several issues have been discovered in the Marshal module: ANT-2026-K7NTK0FT Stale obj counter across unmarshal calls enables null/freed intern obj table indexing ANT-2026-2NJYQWEX Custom block size wraparound in CODE CUSTOM LEN allocation ANT-2026-PJC00M7X Unmarshaler accepts forged Closure tag...

PT-2026-122456

ANT-2026-R7FKP7RG Win32 quote cmd filename misses pipe/redirect metacharacters ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe quote/make cmdline ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped Also includes the fix for OSEC-2026-05 Filename.quote comman...

Astra Linux – Vulnerability in OpAM

In OCaml opam before version 2.5.1, a .install field containing a destination filepath can use ../ to access the parent directory...

CLEANSTART-2026-AL15636 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

CVE-2026-82458 affects multiple packages. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. See references for individual vulnerabilit...

BIT-THRIFT-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

PT-2026-109180

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

PT-2026-109178

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its thrift...

OCaml readblock() Code Execution

The vulnerability of the readblock function in the runtime/intern.c file of the OCaml programming language is related to reading data beyond the allowed range of memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

[SECURITY] Fedora 45 Update: opam-2.5.2-5.fc45

Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...

[SECURITY] Fedora 45 Update: ocaml-xmlrpc-light-0.6.1-92.fc45

XmlRpc-Light is an XmlRpc library written in OCaml...

[SECURITY] Fedora 45 Update: ocaml-zip-1.14-5.fc45

This Objective Caml library provides easy access to compressed files in ZIP and GZIP format, as well as to Java JAR files. It provides functions for reading from and writing to compressed files in these formats...

[SECURITY] Fedora 45 Update: ocaml-zarith-1.14-15.fc45

This library implements arithmetic and logical operations over arbitrary-precision integers. The module is simply named "Z". Its interface is similar to that of the Int32, Int64 and Nativeint modules from the OCaml standard library, with some additional functions. See the file z.mlip for...

[SECURITY] Fedora 45 Update: ocaml-zed-3.2.3-25.fc45

Zed is an abstract engine for text editing. It can be used to write text editors, editing widgets, readlines, ... You just have to connect an engine to your inputs and rendering functions to get an editor. Zed provides: editing state management, multiple cursor support, key-binding helpers, and...

[SECURITY] Fedora 45 Update: ocaml-yamlx-0.5.0-2.fc45

A pure-OCaml YAML 1.2 and 1.1 library with a lossless, comment-preserving AST. Features: - Full YAML 1.2 compliance =E2=80=94 passes all 371 tests from the yaml-test- suite. - Pure OCaml =E2=80=94 no C bindings, no external runtime dependencies. - Lossless AST =E2=80=94 the parsed node tree...