CVE-2026-87735: Ocaml Mirage-Crypto-Pk

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.

Affected products

• Ocaml Mirage-Crypto-Pk: before 2.3.0 (fixed in 2.3.0)

Published 2026-09-09. Last modified 2026-09-09.