Is CVE-2026-87734 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87734 being exploited in the wild.

How severe is CVE-2026-87734?

High severity, with a CVSS score of 7.5, published 9 September 2026.

Is there a fix for CVE-2026-87734?

A patch was published on 2026-07-27: utcp 0.0.6 released with patch using red-black tree for reassembly queue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87734 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87734?

Check whether you run OCaml Utcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87734: utcp out-of-order segment reassembly denial of service

CVE-2026-87734 · Severity: high · CVSS 7.5 · Published 2026-09-09

utcp is an OCaml library that implements TCP protocol functionality. A remote attacker who completes a normal TCP handshake can send a stream of small, out-of-order network segments that never fill the gap in expected data, causing the TCP stack to consume excessive CPU resources and become unresponsive. This attack is inexpensive for the attacker to execute but disproportionately expensive for the victim to process, potentially degrading or disabling services that rely on utcp.

Vendors: OCaml.

Quick answers

Is CVE-2026-87734 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87734 being exploited in the wild.
How severe is CVE-2026-87734?: High severity, with a CVSS score of 7.5, published 9 September 2026.
Which products and versions are affected?: OCaml Utcp before 0.0.6.
Is there a fix for CVE-2026-87734?: A patch was published on 2026-07-27: utcp 0.0.6 released with patch using red-black tree for reassembly queue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87734 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87734?: Check whether you run OCaml Utcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial-of-service condition in utcp's out-of-order segment reassembly mechanism (CWE-400: Uncontrolled Resource Consumption). The vulnerable code maintains a flat list of reassembly entries with no cap per connection; when a remote peer sends many small out-of-order segments, utcp creates one reassembly entry per segment and re-folds (processes) the entire reassembly queue on each new packet arrival. Since the receive window is approximately 65000 bytes, an attacker can create thousands of one-byte entries, each requiring O(n) processing time. Attack vector is network-based with no authentication or user interaction required. An attacker must complete a normal TCP handshake first, then send the malicious segment stream. The fix, released in version 0.0.6 (2026-07-27), replaces the flat list with a red-black binary tree for the reassembly queue, reducing per-packet processing cost from O(n) to O(log n).

Affected products

OCaml utcp before 0.0.6

Timeline

2026-06-25: disclosed: Issue reported to ocaml/security-advisories
2026-07-27: patched: utcp 0.0.6 released with patch using red-black tree for reassembly queue
2026-07-27: advisory: Security advisory published
2026-09-09: other: CVE-2026-87734 published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.