CVE-2026-66858

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

EUVD-2026-91585

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-89086

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS 1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key...

OSEC-2026-19 JOSE: missing RSA signature verification

The opam package "jose" does not validate any RSA signature. It checks the encoding being PKCS1, but does not verify with the public key. Reproduction With jose 0.10.0, the code below signs two tokens with the same key and glues one's payload onto the other's signature: OCaml let =...

PT-2026-89718

Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data. Impact - Cstruct.filter map writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped. - Cstruct.tail rev:true removes two bytes...

EUVD-2012-3469

Malware in sbrugna...

[SECURITY] Fedora 17 Update: ocaml-xml-light-2.3-0.1.svn234.fc17

Xml-Light is a minimal XML parser & printer for OCaml. It provides functions to parse an XML document into an OCaml data structure, work with it, and print it back to an XML document. It support also DTD parsing and checking, and is entirely written in OCaml, hence it does not require additional ...

[SECURITY] Fedora 11 Update: ocaml-postgresql-1.12.3-1.fc11.2

This OCaml-library provides an interface to PostgreSQL, an efficient and reliable, open source, relational database. Almost all functionality available through the C-API libpq is replicated in a type-safe way. This library uses objects for representing database connections and results of queries...