Live › vulnerability › CVE-2026-106971
Go to dashboardThe MessagePack\BufferUnpacker component of the rybakit/msgpack PHP library v0.11.0 has an integer overflow. A crafted input can make the process crash or hang, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:33 UTC. All times on this page are UTC.
Applications that use rybakit/msgpack v0.11.0 and feed it input an outside party can control, particularly through the BufferUnpacker component. Systems that only unpack trusted, internally produced data are much less exposed. Projects not using this library or a different version can skip it.
No product ranges from the sources yet.
composer show rybakit/msgpackrybakit/msgpack in composer.lock and confirm whether it resolves to 0.11.0BufferUnpackerrybakit/msgpack past 0.11.0 to a patched release (the fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
This page as .md · .json · in your agent: get_signal("CVE-2026-106971")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.