Executive brief
utcp is an OCaml library that implements TCP protocol functionality. A remote attacker who completes a normal TCP handshake can send a stream of small, out-of-order network segments that never fill the gap in expected data, causing the TCP stack to consume excessive CPU resources and become unresponsive. This attack is inexpensive for the attacker to execute but disproportionately expensive for the victim to process, potentially degrading or disabling services that rely on utcp.
Technical details
The vulnerability is a denial-of-service condition in utcp's out-of-order segment reassembly mechanism (CWE-400: Uncontrolled Resource Consumption). The vulnerable code maintains a flat list of reassembly entries with no cap per connection; when a remote peer sends many small out-of-order segments, utcp creates one reassembly entry per segment and re-folds (processes) the entire reassembly queue on each new packet arrival. Since the receive window is approximately 65000 bytes, an attacker can create thousands of one-byte entries, each requiring O(n) processing time. Attack vector is network-based with no authentication or user interaction required. An attacker must complete a normal TCP handshake first, then send the malicious segment stream. The fix, released in version 0.0.6 (2026-07-27), replaces the flat list with a red-black binary tree for the reassembly queue, reducing per-packet processing cost from O(n) to O(log n).
Affected products
- OCaml utcp before 0.0.6
Timeline
- 2026-06-25: disclosed: Issue reported to ocaml/security-advisories
- 2026-07-27: patched: utcp 0.0.6 released with patch using red-black tree for reassembly queue
- 2026-07-27: advisory: Security advisory published
- 2026-09-09: other: CVE-2026-87734 published