CVE-2026-87733
Quick assessment
Affected
OCaml mirage-crypto-ec
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 OCaml 的 mirage-crypto-ec 函数中（2.2.0 版本之前）发现了一个问题。其中，ECDSA 函数 {P256, P384, P521}.Dsa.pub_of_octets 会将 0x00（即无穷点的编码）作为公钥接受。使用该公钥时，攻击者可以在没有私钥的情况下伪造签名。
Possible ATT&CK Techniques 1 AI
T1565 · Data Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87733
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OCaml | mirage-crypto-ec | 0 ~ 2.2.0 | - |
|
II. Public POCs for CVE-2026-87733
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87733
请登录查看更多情报信息。
Other References for CVE-2026-87733 (1)
Same Patch Batch · OCaml · 2026-09-09 · 7 CVEs total
| CVE-2026-87734 | 7.5 HIGH | OCaml utcp 0.0.6 前 远程拒绝服务 |
| CVE-2026-87732 | 6.2 MEDIUM | OCaml mirage-crypto <2.2.0解密缓冲区信息泄露 |
| CVE-2026-87737 | 5.9 MEDIUM | mirage-crypto-ec 2.4.0前时序侧信道漏洞 |
| CVE-2026-57825 | 5.7 MEDIUM | OCaml opam 2.5.2前沙箱保护绕过漏洞 |
| CVE-2026-87736 | 4.3 MEDIUM | mirage-crypto-ec 2.3.0前 椭圆曲线公钥越界读取 |
| CVE-2026-87735 | 4.3 MEDIUM | ocaml mirage-crypto-pk<2.3.0 异常处理缺陷 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-87733
No comments yet