dev-newsOCaml logoocaml.org

Latest stable OCaml: 5.5.2, released (5.5.2 release notes). 12 stable releases since 14 Mar 2024.

OCaml.

In short

4.14.5newest stable publication

5.5.2newest 5.x

12 releasesstable since 2024

144 daysbetween the last two 4.14 patches

OCaml 4.14.5 shipped on 6 November 2026. The release notes name six security fixes and two ordinary bug fixes. The maintenance patch follows 4.14.4 by 144 calendar days. It fixes pattern compilation and compatibility with a new macOS version. OCaml 5.5.2 remains the newest 5.x release.

OCaml 5.5.2 came out on 23 October 2026 with fixes for six security advisories, OSEC-2026-21 to 26, and every one of them credits Anthropic as the reporter. They cover Str partial matching, an integer overflow in Unix.map_file, several problems in Marshal, command quoting on Windows and two flaws in the runtime_events consumer. The release also fixes two rare miscompilations, one with atomic loads and one with immediate range patterns. Other fixes cover macOS function detection and a runtime_events infinite loop.

The retained 24 October security-tracker snapshot contains 26 advisories, 10 of them against the compiler and runtime and the rest against packages such as tls, mirage-crypto, opam and cohttp. Marshal has come up three times: in 4.14.3 and 5.4.1 in February, in 5.5.1 in September and again now. 5.5.1 also fixed a type system bug for module-dependent functions.

As of 6 November 2026. OCaml security advisories.

Latest releases

  1. 4.14.5Six security fixes (OSEC-2026-18, 21–24 and 30) and two ordinary bug fixes.
  2. 5.5.2Six security fixes (OSEC-2026-21 to 26) and two miscompilation fixes.
  3. 5.5.1Type system fix for module-dependent functions; Marshal and bytecode loading overflows.
  4. 5.5.0Feature release opening the 5.5 line.
  5. 4.14.4Bigarray reshape overflow (CVE-2026-34353) and Windows filename quoting.
  6. 5.4.1Marshal over-read fix for the 5.4 line.

Which OCaml line should I run?

Use OCaml 5.5.2 for a new project. OCaml 4.14.5 is the newest publication by date, but it patches the older runtime. Create a separate opam switch when testing a compiler upgrade.

Use Dune to rebuild the project in the new switch, then run its tests.

OCaml release notes

Newest publication and newest 5.x compilerThe latest publication is 4.14.5. It arrived 14 calendar days after 5.5.2. Version order and publication order answer different questions.5.x for new projects5.5.2 · 23 October 20264.14 maintenance4.14.5 · 6 November 2026
The latest publication is 4.14.5. It arrived 14 calendar days after 5.5.2. Version order and publication order answer different questions.

How quickly does a new line get its first patch?

A first patch took 77 to 189 days on the 3 patched 5.x lines with their launch in this data. There is no fixed patch deadline here.

OCaml release notes

Days from a 5.x launch to its first patchOnly lines with an observed .0 and a later patch are included. The 3 qualifying lines have a 131-day median first-patch delay. This measures publication timing, not time to fix a reported bug. The 5.3 line has no patch in this dataset.First patch · calendar days5.21895.2.1 · 18 November 20245.41315.4.1 · 17 February 20265.5775.5.1 · 4 September 2026Median: 131 days
Only lines with an observed .0 and a later patch are included. The 3 qualifying lines have a 131-day median first-patch delay. This measures publication timing, not time to fix a reported bug. The 5.3 line has no patch in this dataset.

What does 4.14 maintenance mean beside 5.x?

The 4.14 maintenance line has 4 releases in this window. Its latest patch arrived 144 days after 4.14.4. The 5.x branch spans 4 minor lines. These are observed publications; the chart does not promise future support.

OCaml release notes

2024202520264.144.14OCaml 4.14.2, 2024-03-144.14.2OCaml 4.14.3, 2026-02-174.14.3OCaml 4.14.4, 2026-06-154.14.4OCaml 4.14.5, 2026-11-064.14.55.25.2OCaml 5.2.0, 2024-05-135.2.0OCaml 5.2.1, 2024-11-185.2.15.35.3OCaml 5.3.0, 2025-01-085.3.05.45.4OCaml 5.4.0, 2025-10-095.4.0OCaml 5.4.1, 2026-02-175.4.15.55.5OCaml 5.5.0, 2026-06-195.5.0OCaml 5.5.1, 2026-09-045.5.1OCaml 5.5.2, 2026-10-235.5.2
12 stable OCaml releases since 14 March 2024, one lane per series. The 4.14 line got 4 patch releases in that time while 5.x moved through 4 minor versions. Source: ocaml/ocaml GitHub releases.

Which security advisories reached my compiler?

OCaml 4.14.5 names 6 OSEC IDs: OSEC-2026-18, OSEC-2026-21, OSEC-2026-22, OSEC-2026-23, OSEC-2026-24, OSEC-2026-30. Five use the hyphenated OSEC prefix; the Windows command-quoting entry uses a space. OCaml 5.5.2 also names 6 IDs. Update the compiler line you actually run.

OCaml release notes

OSEC IDs explicitly named in compiler release notes9 distinct OSEC IDs are explicitly named across 3 releases. Each cell is an advisory suffix; repeated IDs represent backports. Both OSEC-2026-24 and the space-separated spelling are counted. Notes without IDs cannot establish an advisory count.4.14.4 · 15 June 2026045.5.2 · 23 October 20262122232425264.14.5 · 6 November 2026182122232430
9 distinct OSEC IDs are explicitly named across 3 releases. Each cell is an advisory suffix; repeated IDs represent backports. Both OSEC-2026-24 and the space-separated spelling are counted. Notes without IDs cannot establish an advisory count.
Advisory register: 24 October snapshot
AdvisoryPackageIssueCVSSJanFebMarAprMayJunJulAugSepOct4.14.3 · 5.4.14.14.45.5.05.5.15.5.22026-01ocamlMarshal over-readOSEC-2026-01, published 2026-02-17, reported by Justin Timperio6.82026-02arpARP memory useOSEC-2026-02, published 2026-02-18, reported by Edwin Török7.42026-03opam-developam sandbox escapeOSEC-2026-03, published 2026-04-15, reported by Andrew Nesbitt5.72026-04ocamlBigarray.reshape overflowOSEC-2026-04, published 2026-06-18, reported by Andriy Sultanov6.12026-05ocamlWindows filename quotingOSEC-2026-05, published 2026-06-18, reported by Andrew Nesbitt6.12026-06tlsTLS client cert checksOSEC-2026-06, published 2026-05-20, reported by Ben Smyth7.42026-07tlsTLS server cert checksOSEC-2026-07, published 2026-05-20, reported by Ben Smyth7.42026-08tartar path traversalOSEC-2026-08, published 2026-05-22, reported by Quentin Stiévenart8.22026-09albatrossAlbatross console memoryOSEC-2026-09, published 2026-05-28, reported by Reynir Björnsson4.92026-10opam-developam symlink sandbox escapeOSEC-2026-10, published 2026-07-07, reported by Kate Deplaix5.72026-11utcputcp reassembly DoSOSEC-2026-11, published 2026-07-27, reported by Thomas Gazagnaire7.52026-12mirage-cryptoAEAD decrypt before tag checkOSEC-2026-12, published 2026-07-27, reported by Thomas Gazagnaire6.22026-13mirage-crypto-ecECDSA point at infinityOSEC-2026-13, published 2026-07-27, reported by Thomas Gazagnaire6.22026-14mirage-crypto-pkRSA verify exceptionOSEC-2026-14, published 2026-08-07, reported by Thomas Gazagnaire4.32026-15mirage-crypto-ecEC key out-of-bounds readOSEC-2026-15, published 2026-08-07, reported by Thomas Gazagnaire4.32026-16cohttpCohttp path traversalOSEC-2026-16, published 2026-08-20, reported by Sapphire Livingstone8.72026-17mirage-crypto-ecEC scalar timing leakOSEC-2026-17, published 2026-08-17, reported by Eric Ebinger5.92026-18ocamlMarshal integer overflowOSEC-2026-18, published 2026-09-10, reported by Akshay M Singh6.82026-19joseJOSE missing RSA checkOSEC-2026-19, published 2026-09-10, reported by Sergey Zhukaev9.12026-20cstructCstruct indexing bugsOSEC-2026-20, published 2026-09-10, reported by Anil Madhavapeddy7.32026-21ocamlStr partial match underflowOSEC-2026-21, published 2026-10-23, reported by Anthropic5.52026-22ocamlUnix.map_file overflowOSEC-2026-22, published 2026-10-23, reported by Anthropic5.52026-23ocamlMarshal, multiple issuesOSEC-2026-23, published 2026-10-23, reported by Anthropic6.82026-24ocamlWindows command quotingOSEC-2026-24, published 2026-10-23, reported by Anthropic7.32026-25ocamlruntime_events overflowOSEC-2026-25, published 2026-10-23, reported by Anthropic4.52026-26ocamlruntime_events type confusionOSEC-2026-26, published 2026-10-23, reported by Anthropic4.5reporter: Anthropicall fixed in 5.5.2
The retained 26-advisory snapshot through 24 October 2026. Orange rows affect the compiler and runtime. Bars show CVSS scores. This snapshot predates the OSEC-2026-30 reference in 4.14.5.

Installing OCaml with opam

Install opam, OCaml's package manager, and let it build the compiler: opam init creates a default switch, an isolated environment holding one compiler and its packages. opam has supported Windows natively since 2.2.0; the current opam release is 2.6.1, from 7 October 2026.

  1. On Linux, macOS or *BSD, make sure gcc, build-essential, curl, unzip and bubblewrap are installed, then run the install script and initialise opam:
    bash -c "sh <(curl -fsSL https://opam.ocaml.org/install.sh)"
    opam init
    eval $(opam env)
  2. On Windows, install Git and opam with winget, then run opam init in a new terminal:
    winget install Git.Git OCaml.opam
  3. Add the OCaml Platform tools to the switch: Dune for builds, the language server for editors, odoc, ocamlformat and the utop REPL:
    opam install dune ocaml-lsp-server odoc ocamlformat utop

If you said no to the shell hook during opam init, run eval $(opam env) in each new shell, or prefix commands with opam exec --. Distribution packages of opam can lag behind and may not know the newest compiler.

Install OCaml opam releases

Which OCaml version to run, and moving to a new one

New projects should use the newest 5.x release. The 4.14 line still gets patch releases for code that can't move to OCaml 5's multicore runtime yet; the chart shows every compiler release since 2024 by series.

  1. Refresh the package list and create a switch for the new compiler. A switch named after a directory is picked automatically when you run opam inside it:
    opam update
    opam switch create 5.5.2
    eval $(opam env)
  2. Reinstall your project's dependencies in the new switch, for example with opam install . --deps-only from a directory with an opam file, then rebuild and run your tests.
  3. Remove the old switch once nothing needs it: opam switch remove <name>.

Creating a switch compiles OCaml from source, which takes a few minutes; the ocaml-system package reuses a compiler installed by your OS instead.

opam usage OCaml releases opam switch manual opam install manual

Pinning a package with opam

opam pin add <package> <target> holds a package at a version, or points it at a local path or a git branch or commit, and opam upgrade then leaves it alone or rebuilds it from that source.

  1. Pin to a version, a checkout, a git ref or the package's upstream repository:
    opam pin add camlpdf 1.7
    opam pin add camlpdf ~/src/camlpdf
    opam pin add opam-lib https://github.com/ocaml/opam.git#1.2
    opam pin add opam-lib --dev-repo
  2. To patch a dependency, fetch its source pinned, edit it, and rebuild from the checkout:
    opam source <package> --dev-repo --pin
    cd <package>
    opam upgrade .
  3. List pins with opam pin list and drop one with opam pin remove <package>.

opam usage: opam pin opam pin manual

Questions people search for

What is the latest version of OCaml?

OCaml 5.5.2, released 23 October 2026 (5.5.2 release notes). Create a switch for it with opam switch create 5.5.2.

Is OCaml 4.14 still maintained?

Yes, it still gets patch releases: the newest is 4.14.5, from 6 November 2026. The 4.14 line exists for code that can't move to OCaml 5's runtime yet; new projects should start on 5.x.

How do I install OCaml on Windows?

Use opam, which runs natively on Windows since 2.2.0: winget install Git.Git OCaml.opam, then opam init in a new terminal. WSL 2 with the Linux instructions also works.

From @ocaml_org on X

OCaml@ocaml_org

[Changelog] Release of OCaml 5.​5.​2: We have the pleasure of celebrating the anniversary of the first powered flight in Europe by announcing the release of OCaml 5.​5.​2.
OCaml 5.​5.​2 fixes various minor security issues, two rare miscompilations, a… dlvr.​it/TW2grr

On X, 24 Oct 2026 07:03:05 UTC

The 5.5.2 announcement, posted the day after the release.