{"id":"CVE-2026-106971","kind":"vulnerability","aliases":["CVE-2026-106971"],"related":[],"title":"rybakit/msgpack: integer overflow in BufferUnpacker enables denial of service","description":"An integer overflow in the MessagePack\\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.","summary":"The MessagePack\\BufferUnpacker component of the rybakit/msgpack PHP library v0.11.0 has an integer overflow. A crafted input can make the process crash or hang, causing denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-servers","composer","package","php","rybakit-msgpack"],"not_affected_if":["not-using-v0.11.0","trusted-input-only"],"how_to_check":"- Check the installed version with `composer show rybakit/msgpack`\n- Look for `rybakit/msgpack` in `composer.lock` and confirm whether it resolves to `0.11.0`\n- Check whether the application unpacks untrusted MessagePack input with `BufferUnpacker`","fix":"- Upgrade `rybakit/msgpack` past `0.11.0` to a patched release (the fixed version is unknown from the sources)\n- Until patched, reject or size-limit untrusted MessagePack payloads before unpacking","status":"open","published_at":"2026-10-28T15:17:02+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","triaged_at":"2026-10-28T15:35:09+00:00","updated_at":"2026-10-28T15:35:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T15:35:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `rybakit/msgpack` past `0.11.0` to a patched release (the fixed version is unknown from the sources)\n- Until patched, reject or size-limit untrusted MessagePack payloads before unpacking","reach":"unknown","title":"rybakit/msgpack: integer overflow in BufferUnpacker enables denial of service","impact":"low","summary":"The MessagePack\\BufferUnpacker component of the rybakit/msgpack PHP library v0.11.0 has an integer overflow. A crafted input can make the process crash or hang, causing denial of service.","category":"package","nicknames":[],"who_cares":["php","composer","rybakit-msgpack","api-servers"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes or stalls the service that unpacks crafted MessagePack input.","analyst_note":"Find the patched version and the exact trigger from the NVD entry or the rybakit/msgpack repository advisory; the sources give no fixed version or severity score.","how_to_check":"- Check the installed version with `composer show rybakit/msgpack`\n- Look for `rybakit/msgpack` in `composer.lock` and confirm whether it resolves to `0.11.0`\n- Check whether the application unpacks untrusted MessagePack input with `BufferUnpacker`","needs_analyst":true,"not_affected_if":["not-using-v0.11.0","trusted-input-only"],"who_is_affected":"Applications that use rybakit/msgpack v0.11.0 and feed it input an outside party can control, particularly through the BufferUnpacker component. Systems that only unpack trusted, internally produced data are much less exposed. Projects not using this library or a different version can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00065,"input_tokens":3288,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106971':12A,15A '-2026':11A,14A 'allow':64C 'api':17B 'api-serv':16B 'attack':65C 'bufferunpack':5A,27B,59C 'caus':49B,67C 'compon':28B,60C 'compos':19B 'craft':40B,75C 'crash':46B 'cve':10A,13A 'denial':7A,50B,69C 'dos':72C 'enabl':6A 'hang':48B 'input':41B,76C 'integ':2A,37B,54C 'librari':33B 'make':43B 'messagepack':26B,58C 'msgpack':24B 'overflow':3A,38B,55C 'packag':20B 'php':21B,32B 'process':45B 'rybakit':23B 'rybakit-msgpack':22B 'rybakit/msgpack':1A,31B,62C 'server':18B 'servic':9A,52B,71C 'v0.11.0':34B,63C 'via':73C","nicknames":[],"mitigations":[],"who_affected":"Applications that use rybakit/msgpack v0.11.0 and feed it input an outside party can control, particularly through the BufferUnpacker component. Systems that only unpack trusted, internally produced data are much less exposed. Projects not using this library or a different version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T15:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106971","severity":null,"published_at":"2026-10-28T15:17:02+00:00","modified_at":"2026-10-28T15:24:56+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","fetched_at":"2026-10-28T15:33:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}