CVE-2026-87734 Overview
CVE-2026-87734 is a remote denial-of-service vulnerability in the utcp package for OCaml, affecting versions before 0.0.6. The flaw resides in the package's segment reassembly logic, where out-of-order TCP segments are mishandled. A remote attacker can send crafted segment sequences to exhaust resources or disrupt processing, rendering the affected service unavailable. The issue is tracked under CWE-923: Improper Restriction of Communication Channel to Intended Endpoints and disclosed through OSEC Vulnerability Advisory OSEC-2026-11.
Critical Impact
Remote unauthenticated attackers can trigger denial of service against any application relying on utcp for TCP segment reassembly, with no user interaction required.
Affected Products
- utcp package for OCaml, all versions prior to 0.0.6
- OCaml applications and services embedding vulnerable utcp releases
- Network stacks and userland TCP implementations built atop utcp
Discovery Timeline
- 2026-09-09 - CVE-2026-87734 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87734
Vulnerability Analysis
The utcp package implements TCP functionality in OCaml, including segment reception and reassembly. When TCP segments arrive out of order, the receiver must buffer them until missing segments fill the sequence gap. The vulnerability arises from how utcp versions before 0.0.6 handle these out-of-order segments during reassembly.
An attacker with network reachability to the target can transmit specially ordered TCP segments that force the reassembly logic into a state that disrupts service availability. Because the attack path is purely network-based and requires no authentication or user interaction, exploitation can be performed by any remote peer capable of completing or influencing a TCP exchange with the vulnerable endpoint.
The EPSS probability is 0.29%, reflecting a low current forecast of in-the-wild exploitation, though no vendor exploit-in-the-wild reports are attached to this advisory.
Root Cause
The root cause is improper handling within the segment reassembly routine in utcp. When segments arrive with sequence numbers outside the expected in-order window, the reassembly code does not enforce sufficient bounds or state constraints, allowing an attacker to steer the receiver into a condition that halts or exhausts normal processing. This aligns with the CWE-923 classification concerning improper restriction of communication channel handling.
Attack Vector
Exploitation occurs over the network against any service that uses utcp for TCP processing. The attacker crafts a sequence of TCP segments with non-monotonic sequence numbers and delivers them to the target. The receiver's reassembly logic mishandles the sequence, producing a denial-of-service condition. The vulnerability affects availability only; confidentiality and integrity are not impacted.
No verified proof-of-concept code is published in the advisory. Refer to the OSEC Vulnerability Advisory OSEC-2026-11 for authoritative technical details.
Detection Methods for CVE-2026-87734
Indicators of Compromise
- Unexpected termination, hangs, or resource exhaustion in OCaml services linking utcp versions earlier than 0.0.6.
- Sustained TCP flows containing highly out-of-order segment sequences directed at services known to use utcp.
- Elevated memory or CPU consumption in processes performing TCP reassembly without corresponding legitimate traffic volume.
Detection Strategies
- Inventory OCaml applications and dependencies to identify any linkage against utcp versions below 0.0.6.
- Deploy network detection rules that flag anomalous TCP segment ordering patterns targeting ports served by OCaml applications.
- Correlate service crash or restart events with concurrent inbound TCP traffic anomalies through centralized log analysis.
Monitoring Recommendations
- Monitor process availability and restart frequency for services built on utcp.
- Capture packet metadata at network chokepoints to establish baselines for legitimate segment ordering and detect deviations.
- Alert on repeated TCP connection resets or reassembly-queue growth reported by host telemetry.
How to Mitigate CVE-2026-87734
Immediate Actions Required
- Upgrade the utcp OCaml package to version 0.0.6 or later across all affected build pipelines and deployments.
- Rebuild and redeploy any OCaml application or service that statically links or vendors an earlier utcp release.
- Audit dependency manifests (opam, lockfiles) to confirm no transitive dependency reintroduces a vulnerable version.
Patch Information
The issue is fixed in utcp version 0.0.6. Consult the OSEC Vulnerability Advisory OSEC-2026-11 for the authoritative patch reference and any additional remediation guidance published by the maintainers.
Workarounds
- Place vulnerable services behind a TCP-aware proxy or load balancer that normalizes segment ordering before traffic reaches the application.
- Restrict network exposure of affected services to trusted peers using firewall rules until the upgrade is applied.
- Implement rate limiting and connection-quota controls to reduce the blast radius of a successful denial-of-service attempt.
# Update the utcp dependency via opam to the fixed release
opam update
opam upgrade utcp
opam list utcp # verify version is >= 0.0.6
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
