Executive brief
Cstruct is a serialization and parsing library for OCaml used in network protocols and data structures. Several indexing functions contain logical errors that can return corrupted data, skip validation checks, or leak unintended buffer contents—potentially bypassing security-critical parsing logic or causing service disruptions. The vulnerabilities have been fixed in version 6.3.0.
Technical details
The cstruct library contains multiple logical indexing and bounds-calculation errors (CWE-682) in functions used for binary data manipulation. Affected functions include Cstruct.filter_map (writes retained bytes at original input positions, corrupting output when earlier bytes are dropped), Cstruct.tail with reverse flag (removes two bytes instead of one), Cstruct.cuts with reverse flag (compares or splits at incorrect positions), and Cstruct.find/find_sub with reverse flag (returns slices from wrong locations on non-zero-offset views). These are not memory-safety vulnerabilities but logical bugs that can return corrupted data, raise unexpected exceptions, or disclose adjacent buffer contents within the backing buffer. In security-sensitive parsers, these faults could enable validation bypasses, denial of service, or information leakage. The fix was released in version 6.3.0 on 2026-09-05.
Affected products
- OCaml cstruct before 6.3.0
Timeline
- 2026-09-04: disclosed: Reported via GitHub to ocaml/security-advisories
- 2026-09-05: patched: Patch reviewed and cstruct 6.3.0 released
- 2026-09-10: advisory: Public advisory published