# OCaml release history: six advisories in 5.5.2

Source page: https://dev-news.anonyfox.com/ocaml/

Every OCaml compiler release since 2024 from GitHub, the 26 OCaml security advisories published in 2026 laid out by date and package, and what 5.5.2 fixed.

## Where it stands (2026-10-24)

OCaml 5.5.2 came out on 23 October 2026 with fixes for six security advisories, OSEC-2026-21 to 26, and every one of them credits Anthropic as the reporter. They cover Str partial matching, an integer overflow in Unix.map_file, several problems in Marshal, command quoting on Windows and two flaws in the runtime_events consumer. The release also fixes two rare miscompilations, one with atomic loads and one with immediate range patterns.

That brings the OCaml security tracker to 26 advisories this year, 10 of them against the compiler and runtime and the rest against packages such as tls, mirage-crypto, opam and cohttp. Marshal has come up three times: in 4.14.3 and 5.4.1 in February, in 5.5.1 in September and again now. 5.5.1 also fixed a type system bug for module-dependent functions.

## Latest stable releases

- [5.5.2](https://github.com/ocaml/ocaml/releases/tag/5.5.2) (2026-10-23): Security fix OSEC-2026-21: Str.stringpartialmatch
- [5.5.1](https://github.com/ocaml/ocaml/releases/tag/5.5.1) (2026-09-04): Type system bug fix for module-dependent functions
- [5.5.0](https://github.com/ocaml/ocaml/releases/tag/5.5.0) (2026-06-19): Module-dependent functions
- [4.14.4](https://github.com/ocaml/ocaml/releases/tag/4.14.4) (2026-06-15): Security fix for check for size overflow in camlbareshape (CVE-2026-34353, OSEC-2026-04)
- [5.4.1](https://github.com/ocaml/ocaml/releases/tag/5.4.1) (2026-02-17)
- [4.14.3](https://github.com/ocaml/ocaml/releases/tag/4.14.3) (2026-02-17)
- [5.4.0](https://github.com/ocaml/ocaml/releases/tag/5.4.0) (2025-10-09): Labelled tuples
- [5.3.0](https://github.com/ocaml/ocaml/releases/tag/5.3.0) (2025-01-08): Syntax for deep effect handlers
- [5.2.1](https://github.com/ocaml/ocaml/releases/tag/5.2.1) (2024-11-18)
- [5.2.0](https://github.com/ocaml/ocaml/releases/tag/5.2.0) (2024-05-13): Re-introduced GC compaction
- [4.14.2](https://github.com/ocaml/ocaml/releases/tag/4.14.2) (2024-03-14)

## In the dev-news log

- **OCaml 5.5.2** (2026-10-23). Six security fixes, OSEC-2026-21 to OSEC-2026-26, covering `Str.string_partial_match`, demarshaling, Windows command quoting and the runtime events library. Also two miscompilation fixes. First release since 5.5.1 on 4 September. [log](https://dev-news.anonyfox.com/log/2026-10-23/#ocaml-1)

Releases since 2024: 11 stable, 0 prereleases. JSON: https://dev-news.anonyfox.com/ocaml.json. Feed: https://dev-news.anonyfox.com/ocaml/feed.xml