Hi,

The following vulnerability was published for ocaml-cstruct.

CVE-2026-89087[0]:
| The cstruct package before 6.3.0 for OCaml mishandles indexes.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-89087
https://www.cve.org/CVERecord?id=CVE-2026-89087
[1] https://osv.dev/vulnerability/OSEC-2026-20
[2] https://github.com/mirage/ocaml-cstruct/pull/324

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
ocaml-cstruct, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147522@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stéphane Glondu <glondu@debian.org> (supplier of updated ocaml-cstruct package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 14 Sep 2026 08:39:40 +0200
Source: ocaml-cstruct
Architecture: source
Version: 6.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OCaml Maintainers <debian-ocaml-maint@lists.debian.org>
Changed-By: Stéphane Glondu <glondu@debian.org>
Closes: 1147522
Changes:
 ocaml-cstruct (6.3.0-1) unstable; urgency=medium
 .
   * New upstream release (Closes: #1147522, CVE-2026-89087)
   * Switch debian/watch to version 5
   * Bump Standards-Version to 4.7.4
   * Bump debhelper compat level to 14
   * Remove Priority and Rules-Requires-Root from debian/control
Checksums-Sha1:
 6381f5416bb7a78dae4cb8bda1d66dcbca63b88c 2119 ocaml-cstruct_6.3.0-1.dsc
 3024a2a263367b6fc261084a3e3dd15a66352008 244860 ocaml-cstruct_6.3.0.orig.tar.gz
 c397f9d4ae22a1bdf51860307c115e40465434f1 3556 ocaml-cstruct_6.3.0-1.debian.tar.xz
Checksums-Sha256:
 d5191eabf30eedcdda2c7e1d195e327ff9ca1c28c8dda26d474a38cd72ce0ac8 2119 ocaml-cstruct_6.3.0-1.dsc
 c0ffb7be74ec7e960beb1a0aa1614179e6041602deb2f3a6531db97f35c797a9 244860 ocaml-cstruct_6.3.0.orig.tar.gz
 dbb670b6fd4e62991cdfdca40da0142d926ba683267d2830772bfd8c0e702a7e 3556 ocaml-cstruct_6.3.0-1.debian.tar.xz
Files:
 65162b8bdb3482fc9d91c88b7d2fc490 2119 ocaml optional ocaml-cstruct_6.3.0-1.dsc
 5ffbff4b1f38396d7bfae58b1b664367 244860 ocaml optional ocaml-cstruct_6.3.0.orig.tar.gz
 0465ce22b60958688ebef8646d095cc1 3556 ocaml optional ocaml-cstruct_6.3.0-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQFGBAEBCgAwFiEEbeJOl+yohsxW5iUOIbju8bGJMIEFAmqnnhsSHGdsb25kdUBk
ZWJpYW4ub3JnAAoJECG47vGxiTCBdbQH/2QevnFsOkcXQnT23fbasgs7Eoqdch6x
sfLrOQEYIA653DzLFqGGFcqIkmm23gU2rXlIVrk2yy3BejG5szl/clHCRVTNljCf
dnmswTjsISpVL7ZJCACVUQe+UlxB8UfmtP5rqu0IAkBrGd9w8b6RlM8hX9Wc35Xa
oKGGEadKs86yqShn0Y1ZFwmz2zEV5UQjRtBcUAm0DelBY8JJVn4vbwUL2mZaxmmj
FdejoDb8uZ292f3ecNlsl7F07lwBwvpUb/YQfKRaFlStn1r2F4LDcu6ubKlBX5Gg
t2t+3RlwUMc8TLff8KcqoaFbmjLWQAvmai9gqSW8GQN6NZIpGzzx/UI=
=lYQz
-----END PGP SIGNATURE-----