CVE-2026-89087: Ocaml Cstruct

High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The cstruct package before 6.3.0 for OCaml mishandles indexes.

Affected products

• Ocaml Cstruct: before 6.3.0 (fixed in 6.3.0)

Published 2026-09-10. Last modified 2026-09-22.