dev-newsOCaml logoocaml.org

Latest stable OCaml: 5.5.2, released (release notes). 11 stable releases since 14 Mar 2024.

OCaml.

26 advisories · 10 in the compilerPublished on the OCaml security tracker in 2026, as of 24 October 2026.

AdvisoryPackageIssueCVSSJanFebMarAprMayJunJulAugSepOct4.14.3 · 5.4.14.14.45.5.05.5.15.5.22026-01ocamlMarshal over-readOSEC-2026-01, published 2026-02-17, reported by Justin Timperio6.82026-02arpARP memory useOSEC-2026-02, published 2026-02-18, reported by Edwin Török7.42026-03opam-developam sandbox escapeOSEC-2026-03, published 2026-04-15, reported by Andrew Nesbitt5.72026-04ocamlBigarray.reshape overflowOSEC-2026-04, published 2026-06-18, reported by Andriy Sultanov6.12026-05ocamlWindows filename quotingOSEC-2026-05, published 2026-06-18, reported by Andrew Nesbitt6.12026-06tlsTLS client cert checksOSEC-2026-06, published 2026-05-20, reported by Ben Smyth7.42026-07tlsTLS server cert checksOSEC-2026-07, published 2026-05-20, reported by Ben Smyth7.42026-08tartar path traversalOSEC-2026-08, published 2026-05-22, reported by Quentin Stiévenart8.22026-09albatrossAlbatross console memoryOSEC-2026-09, published 2026-05-28, reported by Reynir Björnsson4.92026-10opam-developam symlink sandbox escapeOSEC-2026-10, published 2026-07-07, reported by Kate Deplaix5.72026-11utcputcp reassembly DoSOSEC-2026-11, published 2026-07-27, reported by Thomas Gazagnaire7.52026-12mirage-cryptoAEAD decrypt before tag checkOSEC-2026-12, published 2026-07-27, reported by Thomas Gazagnaire6.22026-13mirage-crypto-ecECDSA point at infinityOSEC-2026-13, published 2026-07-27, reported by Thomas Gazagnaire6.22026-14mirage-crypto-pkRSA verify exceptionOSEC-2026-14, published 2026-08-07, reported by Thomas Gazagnaire4.32026-15mirage-crypto-ecEC key out-of-bounds readOSEC-2026-15, published 2026-08-07, reported by Thomas Gazagnaire4.32026-16cohttpCohttp path traversalOSEC-2026-16, published 2026-08-20, reported by Sapphire Livingstone8.72026-17mirage-crypto-ecEC scalar timing leakOSEC-2026-17, published 2026-08-17, reported by Eric Ebinger5.92026-18ocamlMarshal integer overflowOSEC-2026-18, published 2026-09-10, reported by Akshay M Singh6.82026-19joseJOSE missing RSA checkOSEC-2026-19, published 2026-09-10, reported by Sergey Zhukaev9.12026-20cstructCstruct indexing bugsOSEC-2026-20, published 2026-09-10, reported by Anil Madhavapeddy7.32026-21ocamlStr partial match underflowOSEC-2026-21, published 2026-10-23, reported by Anthropic5.52026-22ocamlUnix.map_file overflowOSEC-2026-22, published 2026-10-23, reported by Anthropic5.52026-23ocamlMarshal, multiple issuesOSEC-2026-23, published 2026-10-23, reported by Anthropic6.82026-24ocamlWindows command quotingOSEC-2026-24, published 2026-10-23, reported by Anthropic7.32026-25ocamlruntime_events overflowOSEC-2026-25, published 2026-10-23, reported by Anthropic4.52026-26ocamlruntime_events type confusionOSEC-2026-26, published 2026-10-23, reported by Anthropic4.5reporter: Anthropicall fixed in 5.5.2
Every OSEC-2026 advisory from the ocaml/security-advisories repository. Orange rows affect the compiler and runtime; dashed rules are compiler releases; bars are the CVSS score out of 10.

OCaml 5.5.2 came out on 23 October 2026 with fixes for six security advisories, OSEC-2026-21 to 26, and every one of them credits Anthropic as the reporter. They cover Str partial matching, an integer overflow in Unix.map_file, several problems in Marshal, command quoting on Windows and two flaws in the runtime_events consumer. The release also fixes two rare miscompilations, one with atomic loads and one with immediate range patterns.

That brings the OCaml security tracker to 26 advisories this year, 10 of them against the compiler and runtime and the rest against packages such as tls, mirage-crypto, opam and cohttp. Marshal has come up three times: in 4.14.3 and 5.4.1 in February, in 5.5.1 in September and again now. 5.5.1 also fixed a type system bug for module-dependent functions.

As of 24 October 2026. OCaml security advisories.

Latest releases

  1. 5.5.2Six security fixes (OSEC-2026-21 to 26) and two miscompilation fixes.
  2. 5.5.1Type system fix for module-dependent functions; Marshal and bytecode loading overflows.
  3. 5.5.0Feature release opening the 5.5 line.
  4. 4.14.4Bigarray reshape overflow (CVE-2026-34353) and Windows filename quoting.
  5. 5.4.1Marshal over-read fix for the 5.4 line.
  6. 4.14.3Marshal over-read fix for the 4.14 line.

Installing OCaml with opam

Install opam, OCaml's package manager, and let it build the compiler: opam init creates a default switch, an isolated environment holding one compiler and its packages. opam has supported Windows natively since 2.2.0; the current opam release is 2.6.1, from 7 October 2026.

  1. On Linux, macOS or *BSD, make sure gcc, build-essential, curl, unzip and bubblewrap are installed, then run the install script and initialise opam:
    bash -c "sh <(curl -fsSL https://opam.ocaml.org/install.sh)"
    opam init
    eval $(opam env)
  2. On Windows, install Git and opam with winget, then run opam init in a new terminal:
    winget install Git.Git OCaml.opam
  3. Add the OCaml Platform tools to the switch: Dune for builds, the language server for editors, odoc, ocamlformat and the utop REPL:
    opam install dune ocaml-lsp-server odoc ocamlformat utop

If you said no to the shell hook during opam init, run eval $(opam env) in each new shell, or prefix commands with opam exec --. Distribution packages of opam can lag behind and may not know the newest compiler.

Install OCaml opam releases

Which OCaml version to run, and moving to a new one

New projects should use the newest 5.x release. The 4.14 line still gets patch releases for code that can't move to OCaml 5's multicore runtime yet; the chart shows every compiler release since 2024 by series.

2024202520264.144.14OCaml 4.14.2, 2024-03-144.14.2OCaml 4.14.3, 2026-02-174.14.3OCaml 4.14.4, 2026-06-154.14.45.25.2OCaml 5.2.0, 2024-05-135.2.0OCaml 5.2.1, 2024-11-185.2.15.35.3OCaml 5.3.0, 2025-01-085.3.05.45.4OCaml 5.4.0, 2025-10-095.4.0OCaml 5.4.1, 2026-02-175.4.15.55.5OCaml 5.5.0, 2026-06-195.5.0OCaml 5.5.1, 2026-09-045.5.1OCaml 5.5.2, 2026-10-235.5.2
11 stable OCaml releases since 14 March 2024, one lane per series. The 4.14 line got 3 patch releases in that time while 5.x moved through 4 minor versions. Source: ocaml/ocaml GitHub releases.
  1. Refresh the package list and create a switch for the new compiler. A switch named after a directory is picked automatically when you run opam inside it:
    opam update
    opam switch create 5.5.2
    eval $(opam env)
  2. Reinstall your project's dependencies in the new switch, for example with opam install . --deps-only from a directory with an opam file, then rebuild and run your tests.
  3. Remove the old switch once nothing needs it: opam switch remove <name>.

Creating a switch compiles OCaml from source, which takes a few minutes; the ocaml-system package reuses a compiler installed by your OS instead.

opam usage OCaml releases opam switch manual opam install manual

Pinning a package with opam

opam pin add <package> <target> holds a package at a version, or points it at a local path or a git branch or commit, and opam upgrade then leaves it alone or rebuilds it from that source.

  1. Pin to a version, a checkout, a git ref or the package's upstream repository:
    opam pin add camlpdf 1.7
    opam pin add camlpdf ~/src/camlpdf
    opam pin add opam-lib https://github.com/ocaml/opam.git#1.2
    opam pin add opam-lib --dev-repo
  2. To patch a dependency, fetch its source pinned, edit it, and rebuild from the checkout:
    opam source <package> --dev-repo --pin
    cd <package>
    opam upgrade .
  3. List pins with opam pin list and drop one with opam pin remove <package>.

opam usage: opam pin opam pin manual

Questions people search for

What is the latest version of OCaml?

OCaml 5.5.2, released 23 October 2026 (release notes). Create a switch for it with opam switch create 5.5.2.

Is OCaml 4.14 still maintained?

Yes, it still gets patch releases: the newest is 4.14.4, from 15 June 2026. The 4.14 line exists for code that can't move to OCaml 5's runtime yet; new projects should start on 5.x.

How do I install OCaml on Windows?

Use opam, which runs natively on Windows since 2.2.0: winget install Git.Git OCaml.opam, then opam init in a new terminal. WSL 2 with the Linux instructions also works.

From @ocaml_org on X

OCaml@ocaml_org

[Changelog] Release of OCaml 5.​5.​2: We have the pleasure of celebrating the anniversary of the first powered flight in Europe by announcing the release of OCaml 5.​5.​2.
OCaml 5.​5.​2 fixes various minor security issues, two rare miscompilations, a… dlvr.​it/TW2grr

On X, 24 Oct 2026 07:03:05 UTC

The 5.5.2 announcement, posted the day after the release.