CVE-2026-106972: Packagist/rybakit/msgpack vulnerability

Published Oct 28, 2026

Updated

An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Affected Software

1 affected component

packagist/rybakit/msgpack=0.11.0

Event History

Oct 28, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to supply crafted input that is processed by MessagePack\BufferUnpacker::unpack(). The reported impact is denial of service through uncontrolled recursion.

Which package version is identified as affected?

The provided information identifies rybakit/msgpack v0.11.0. No unaffected or fixed version is specified.

CVE-2026-106972: Packagist/rybakit/msgpack vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which package version is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which package version is identified as affected?