{"id":"CVE-2026-106972","kind":"vulnerability","aliases":["CVE-2026-106972"],"related":[],"title":"rybakit/msgpack: unbounded recursion in BufferUnpacker lets crafted input crash service","description":"An uncontrolled recursion in the MessagePack\\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.","summary":"The rybakit/msgpack PHP library v0.11.0 has an uncontrolled recursion flaw in MessagePack\\BufferUnpacker::unpack(). A crafted MessagePack input can exhaust the stack and cause a denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-backends","composer","package","php","rybakit-msgpack"],"not_affected_if":["different-version","no-untrusted-input"],"how_to_check":"- Run `composer show rybakit/msgpack` and check whether the installed version is `0.11.0`.\n- Search `composer.lock` for `rybakit/msgpack` to find the locked version.\n- Find code that calls `BufferUnpacker::unpack()` on data from untrusted sources.","fix":"- Upgrade `rybakit/msgpack` to a release newer than `0.11.0` once the sources name one; the sources do not name a fixed version.\n- Until patched, reject or size-limit untrusted MessagePack input before unpacking.","status":"open","published_at":"2026-10-28T15:17:02+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","triaged_at":"2026-10-28T15:35:09+00:00","updated_at":"2026-10-28T15:35:09+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T15:35:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `rybakit/msgpack` to a release newer than `0.11.0` once the sources name one; the sources do not name a fixed version.\n- Until patched, reject or size-limit untrusted MessagePack input before unpacking.","reach":"unknown","title":"rybakit/msgpack: unbounded recursion in BufferUnpacker lets crafted input crash service","impact":"low","summary":"The rybakit/msgpack PHP library v0.11.0 has an uncontrolled recursion flaw in MessagePack\\BufferUnpacker::unpack(). A crafted MessagePack input can exhaust the stack and cause a denial of service.","category":"package","nicknames":[],"who_cares":["php","composer","rybakit-msgpack","api-backends"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Crafted input crashes the PHP process through stack exhaustion","analyst_note":"Find the fixed version and the advisory for CVE-2026-106972 in the rybakit/msgpack repository or on NVD; sources did not give a patched release.","how_to_check":"- Run `composer show rybakit/msgpack` and check whether the installed version is `0.11.0`.\n- Search `composer.lock` for `rybakit/msgpack` to find the locked version.\n- Find code that calls `BufferUnpacker::unpack()` on data from untrusted sources.","needs_analyst":true,"not_affected_if":["no-untrusted-input","different-version"],"who_is_affected":"Applications that use rybakit/msgpack v0.11.0 to decode MessagePack data from untrusted sources, such as network requests or user uploads, are exposed. Applications that only unpack data they produce themselves, or that do not use this library, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":3300,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106972':13A,16A '-2026':12A,15A 'allow':66C 'api':18B 'api-backend':17B 'attack':67C 'backend':19B 'bufferunpack':5A,38B,60C 'caus':49B,69C 'compon':62C 'compos':20B 'craft':7A,41B,77C 'crash':9A 'cve':11A,14A 'denial':51B,71C 'dos':74C 'exhaust':45B 'flaw':35B 'input':8A,43B,78C 'let':6A 'librari':29B 'messagepack':37B,42B,59C 'msgpack':25B 'packag':21B 'php':22B,28B 'recurs':3A,34B,56C 'rybakit':24B 'rybakit-msgpack':23B 'rybakit/msgpack':1A,27B,64C 'servic':10A,53B,73C 'stack':47B 'unbound':2A 'uncontrol':33B,55C 'unpack':39B,61C 'v0.11.0':30B,65C 'via':75C","nicknames":[],"mitigations":[],"who_affected":"Applications that use rybakit/msgpack v0.11.0 to decode MessagePack data from untrusted sources, such as network requests or user uploads, are exposed. Applications that only unpack data they produce themselves, or that do not use this library, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T15:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106972","severity":null,"published_at":"2026-10-28T15:17:02+00:00","modified_at":"2026-10-28T15:24:56+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","fetched_at":"2026-10-28T15:33:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}