Is CVE-2026-89087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89087 being exploited in the wild.

How severe is CVE-2026-89087?

High severity, with a CVSS score of 7.3, published 10 September 2026.

Is there a fix for CVE-2026-89087?

A patch was published on 2026-09-05: Patch reviewed and cstruct 6.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89087 attacked?

It is attacked over the network.

Am I affected by CVE-2026-89087?

Check whether you run OCaml Cstruct at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89087: cstruct indexing bugs in filter_map, tail, cuts, and find

CVE-2026-89087 · Severity: high · CVSS 7.3 · Published 2026-09-10

Cstruct is a serialization and parsing library for OCaml used in network protocols and data structures. Several indexing functions contain logical errors that can return corrupted data, skip validation checks, or leak unintended buffer contents—potentially bypassing security-critical parsing logic or causing service disruptions. The vulnerabilities have been fixed in version 6.3.0.

Vendors: OCaml.

Quick answers

Is CVE-2026-89087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89087 being exploited in the wild.
How severe is CVE-2026-89087?: High severity, with a CVSS score of 7.3, published 10 September 2026.
Which products and versions are affected?: OCaml Cstruct before 6.3.0.
Is there a fix for CVE-2026-89087?: A patch was published on 2026-09-05: Patch reviewed and cstruct 6.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89087 attacked?: It is attacked over the network.
Am I affected by CVE-2026-89087?: Check whether you run OCaml Cstruct at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The cstruct library contains multiple logical indexing and bounds-calculation errors (CWE-682) in functions used for binary data manipulation. Affected functions include Cstruct.filter_map (writes retained bytes at original input positions, corrupting output when earlier bytes are dropped), Cstruct.tail with reverse flag (removes two bytes instead of one), Cstruct.cuts with reverse flag (compares or splits at incorrect positions), and Cstruct.find/find_sub with reverse flag (returns slices from wrong locations on non-zero-offset views). These are not memory-safety vulnerabilities but logical bugs that can return corrupted data, raise unexpected exceptions, or disclose adjacent buffer contents within the backing buffer. In security-sensitive parsers, these faults could enable validation bypasses, denial of service, or information leakage. The fix was released in version 6.3.0 on 2026-09-05.

Affected products

OCaml cstruct before 6.3.0

Timeline

2026-09-04: disclosed: Reported via GitHub to ocaml/security-advisories
2026-09-05: patched: Patch reviewed and cstruct 6.3.0 released
2026-09-10: advisory: Public advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.