CVE-2026-87734

utcp, a TCP protocol library for OCaml, mishandles the reassembly of TCP segments that arrive out of order, a flaw that a remote attacker can trigger with crafted network traffic. Because the affected code path requires no authentication or user interaction, any party able to send packets to a service or application built on the library can trigger the condition. A successful attack results in a denial of service on the receiving process, with no confidentiality or integrity impact, consistent with the CVSS 3.1 score of 7.5 (High) with availability-only impact. All applications linked against utcp versions prior to 0.0.6 are affected; version 0.0.6 contains the fix. No public proof-of-concept or in-the-wild exploitation is known, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade utcp to version 0.0.6 or later and rebuild any applications that link against the library. Check opam pins and dependency manifests for utcp versions in use; where an immediate upgrade is not possible, limit network exposure of utcp-based services and watch for unexplained crashes or hangs.