Live › vulnerability › CVE-2026-106972
Go to dashboardThe rybakit/msgpack PHP library v0.11.0 has an uncontrolled recursion flaw in MessagePack\BufferUnpacker::unpack(). A crafted MessagePack input can exhaust the stack and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:33 UTC. All times on this page are UTC.
Applications that use rybakit/msgpack v0.11.0 to decode MessagePack data from untrusted sources, such as network requests or user uploads, are exposed. Applications that only unpack data they produce themselves, or that do not use this library, can skip it.
No product ranges from the sources yet.
composer show rybakit/msgpack and check whether the installed version is 0.11.0.composer.lock for rybakit/msgpack to find the locked version.BufferUnpacker::unpack() on data from untrusted sources.rybakit/msgpack to a release newer than 0.11.0 once the sources name one; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
This page as .md · .json · in your agent: get_signal("CVE-2026-106972")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.