Argos

Argos — Blockchain Asset Tracing Platform Argos is a multi-language blockchain investigation platform for tracing, analyzing, and visualizing fund flows on Ethereum and Bitcoin. Built with Rust, OCaml, and TypeScript/React. Architecture +-----------------------+ | Frontend React 19 | | Vite +...

infer

Infer Infer is a static analysis tool for Java, C++, Objective-C, and C. Infer is written in OCaml. Installation Read our Getting Started page for details on how to install packaged versions of Infer. To build Infer from source, see INSTALL.md. Contributing See CONTRIBUTING.md. License Infer is...

redexer

redexer Redexer is a reengineering tool that manipulates Android app binaries. This tool is able to parse a DEX file into an in-memory data structure; to infer with which parameters the app uses certain permissions we name this feature RefineDroid; to modify and unparse that data structure to...

ocaml-marshal-vulnerability

I found a bug in OCaml's fix for CVE-2026-28364 While working on an OCaml project that deserializes data with Marshal, a malformed input took the process down with a SIGBUS instead of a clean exception. I pulled the OCaml runtime and started reading runtime/intern.c. The earlier CVE-2026-28364 fi...

OSEC-2026-30 Ephemeron data is freed while still referenced when the key is an `Infix_tag` closure

Summary In OCaml before 4.14.5, when the key of an ephemeron is a closure with Infixtag a function of a mutually recursive group that is not the first function, the mark phase does not keep the ephemeron's data alive, although the key is alive. The clean phase does treat the key as alive, so it...

OSEC-2026-26 runtime_events user event name-based type confusion

ANT-2026-DTBY2HWS Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type which can be custom/unit/span/int and then has the same event with a different message type. This would never be encountered in a real program b...

OSEC-2026-25 Heap buffer overflow in the OCaml `runtime_events` consumer when parsing an oversized custom user event

ANT-2026-0JXJVEVY Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type which can be custom/unit/span/int and then has the same event with a different message type. This would never be encountered in a real program b...

OSEC-2026-24 Multiple issues in command quoting on Windows

ANT-2026-R7FKP7RG Win32 quotecmdfilename misses pipe/redirect metacharacters ANT-2026-SRZZ62SD Windows batch-file argument injection via maybequote/makecmdline ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped Also includes the fix for OSEC-2026-05 Filename.quotecommand...

PT-2026-135868

ANT-2026-DTBY2HWS Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type which can be custom/unit/span/int and then has the same event with a different message type. This would never be encountered in a real program b...

PT-2026-135867

ANT-2026-0JXJVEVY Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type which can be custom/unit/span/int and then has the same event with a different message type. This would never be encountered in a real program b...

PT-2026-122455

Several issues have been discovered in the Marshal module: ANT-2026-K7NTK0FT Stale obj counter across unmarshal calls enables null/freed intern obj table indexing ANT-2026-2NJYQWEX Custom block size wraparound in CODE CUSTOM LEN allocation ANT-2026-PJC00M7X Unmarshaler accepts forged Closure tag...

PT-2026-135866

ANT-2026-6W9NPC2Q mmap dimension product integer overflow Fix Use caml umul overflow instead of when multiplying bigarray dimensions, which detects integer overflows and raise Failure. Negative positions are also rejected by raising Invalid argument. Am I affected? If either the dimensions or the...

PT-2026-122456

ANT-2026-R7FKP7RG Win32 quote cmd filename misses pipe/redirect metacharacters ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe quote/make cmdline ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped Also includes the fix for OSEC-2026-05 Filename.quote comman...

Astra Linux – Vulnerability in OpAM

In OCaml opam before version 2.5.1, a .install field containing a destination filepath can use ../ to access the parent directory...

CLEANSTART-2026-AL15636 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

CVE-2026-82458 affects multiple packages. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. See references for individual vulnerabilit...

BIT-THRIFT-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

PT-2026-109180

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

PT-2026-109178

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its thrift...

OCaml readblock() Code Execution

The vulnerability of the readblock function in the runtime/intern.c file of the OCaml programming language is related to reading data beyond the allowed range of memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

[SECURITY] Fedora 45 Update: opam-2.5.2-5.fc45

Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...