EUVD-2026-74620
GHSA-798p-53r8-rvx4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted out-of-order TCP segments
-
ExploitTrigger flawed reassembly buffer logic in utcp
-
ExecutionExhaust resources or crash library state
-
ImpactService becomes unavailable
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V12 - Secure Communication Improper restriction of communication channel
|
| Exploitation Conditions | No special conditions beyond network access to a service using the utcp OCaml library - the CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating remote unauthenticated exploitation against any utcp-backed service. The limiting factor is deployment scope: only OCaml applications that explicitly use utcp as their TCP stack (rather than the OS kernel TCP implementation) are vulnerable. Standard OS-level TCP services are unaffected. No specific configuration flags or non-default modes are required to trigger the flaw. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a realistic network-reachable DoS requiring no authentication and no special conditions, which aligns with the description of a remote reassembly flaw. The availability-only impact (C:N/I:N/A:H) is consistent with a pure DoS, as no data exfiltration or integrity violation is described. The low attack complexity (AC:L) is plausible if the triggering condition is simply sending out-of-order packets, which is trivially automatable. However, the real-world risk is moderated significantly by the niche deployment footprint of utcp - this is a specialised OCaml library with limited production adoption compared to kernel TCP stacks. No EPSS score, CISA KEV listing, or POC is available in the provided data, suggesting no observed exploitation. The advisory is tracked only through OSV (OSEC-2026-11), with no independent vendor advisory or NVD enrichment confirmed. The practical blast radius is limited to OCaml applications explicitly depending on utcp for their networking layer, which narrows the affected population considerably. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted stream of TCP segments with deliberate out-of-order sequencing to a service built on the utcp library. The malformed reassembly state causes resource exhaustion or a crash in the library's segment buffer, rendering the targeted service unavailable. No exploit code is publicly known, but the low attack complexity means that a capable attacker could construct a triggering payload by experimenting with TCP sequence number manipulation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Remote denial of service in the utcp OCaml TCP userspace library before version 0.0.6 is possible via crafted out-of-order TCP segment sequences that expose a flaw in the segment reassembly logic. Unauthenticated network attackers can exploit this against any service built on the affected library, causing complete availability loss. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Upgrade the utcp OCaml package to version 0.0.6 or later, which resolves the out-of-order segment reassembly flaw. The fix is documented in the OSV advisory at https://osv.dev/vulnerability/OSEC-2026-11. For applications that cannot immediately upgrade, compensating controls include deploying a network-layer firewall or rate limiter upstream to restrict TCP segment injection from untrusted sources, and isolating utcp-based services from public network exposure until patching is complete. Note that rate-limiting alone does not eliminate the vulnerability if an attacker can send a small crafted sequence sufficient to trigger the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The utcp package (CPE: cpe:2.3:a:ocaml:utcp:*:*:*:*:*:*:*:*) is a userspace TCP implementation written in OCaml, providing TCP protocol handling outside the kernel stack. The vulnerability class is CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints), which here manifests as a failure to properly validate or bound resources during TCP segment reassembly. When TCP segments arrive out of order, they must be buffered and reordered before delivery to the application. A flaw in this reassembly path - such as unbounded buffer growth, incorrect state tracking, or a crash on unexpected segment overlap - allows an attacker to trigger denial of service by sending specially crafted out-of-order segment sequences. All versions prior to 0.0.6 are affected.
Know when Utcp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no auth or user interaction required; availability-only impact from DoS; no confidentiality or integrity effect described.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.
Executive ViewAI
The utcp OCaml TCP library contains a remote denial-of-service vulnerability affecting any networked service built with it. Unauthenticated attackers can crash services by sending specially crafted TCP packet sequences, resulting in complete availability loss. Organizations using this library in production services face immediate risk of service disruption without a vendor patch currently available.
Until a vendor patch is available: implement network segmentation to restrict unauthenticated access to services running utcp, enable stateful firewall rules and rate limiting for malformed TCP segment sequences, deploy network-based intrusion detection tuned to identify out-of-order TCP segment anomalies, and maintain offline backups of critical service state to enable rapid recovery from DoS events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB