CVE-2026-106971

HighCVSS 7.5

Published: 28/10/2026(UTC)Updated: 03/11/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0. On 32-bit PHP, crafted MessagePack input can cause denial of service.

Risk Assessment

Applications running on 32-bit PHP and decoding untrusted MessagePack data may crash or hang.

Recommendation

Update rybakit/msgpack to version 0.11.0 or later; consider migrating to 64-bit PHP.

Other vulnerabilities in rybakit/msgpack

CVE-2026-106972High
Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0. An attacker can cause memory exhaustion when decoding deeply nested MessagePack input.

Original NVD description (English source)

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP

Vulnerability data from NVD (NIST) · CISA KEV · EPSS