Vulnerability Description
Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md
- https://github.com/rybakit/msgpack.php
- https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0
- https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106972.md
FAQ
What is CVE-2026-106972?
CVE-2026-106972 is a vulnerability with a CVSS score of 7.5 (HIGH). Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application d...
How severe is CVE-2026-106972?
CVE-2026-106972 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-106972?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.