CVE-2026-106972

HighCVSS 7.5

Published: 28/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0. An attacker can cause memory exhaustion when decoding deeply nested MessagePack input.

Risk Assessment

Applications decoding MessagePack data from untrusted sources can be driven into memory exhaustion and denial of service.

Recommendation

Update rybakit/msgpack to version 0.11.0 or later and limit the nesting depth of decoded data.

Other vulnerabilities in rybakit/msgpack

CVE-2026-106971High
An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0. On 32-bit PHP, crafted MessagePack input can cause denial of service.

Original NVD description (English source)

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS