Directory Traversal Vulnerability in OCaml's Cohttp Package
CVE-2026-82481

8.7HIGH

Key Information:

Vendor

Mirage

Status
Cohttp
Vendor
CVE Published:
29 August 2026

What is CVE-2026-82481?

A vulnerability in the cohttp package versions prior to 6.3.0 for OCaml allows attackers to conduct directory traversal attacks. This misconfiguration can enable unauthorized access to restricted files on the server, potentially leading to sensitive information disclosure. It is recommended that users upgrade to the latest version to mitigate this security risk.

Affected Version(s)

cohttp 0 < 6.3.0

References

https://github.com/mirage/ocaml-cohttp/pull/1145

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.